[cx-goncalo-lemos]

Closes #

Proposed Changes
Update Gitlab-Pat-Routable regex for new Gitlab token format
Add GitlabPatRoutable to validation function

Checklist

• I covered my changes with tests.
• I Updated the documentation that is affected by my changes:
• Change in the CLI arguments
• Change in the configuration file

I submit this contribution under the Apache-2.0 license.

[cx-artur-ribeiro]

Hi @cx-goncalo-lemos,
Can you please add tests for the new gitlabPatRoutable regex please? Follow the same structure as already existent query tests please.

Additionally, you will need to make a new release for 2ms and update microengines-2ms repo in both 2ms_version.txt and go.mod. We can take this ofline as it is not related to this repo, but for the changes to be present on the client's side, this is also needed.

Regarding the failing pipelines, we already have a PR that needs to be merged before this PR: #401. After that, you should be able to check the pipelines for any security or unit tests related failures, and fix them accordingly if needed.

[stepsecurity-app]

Security Policy Alert: Secret Policy Violation

This workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch.

Secret references detected:

• secrets.AST_RND_SCANS_BASE_URI at line 22
• secrets.AST_RND_SCANS_TENANT at line 23
• secrets.AST_RND_SCANS_CLIENT_ID at line 24
• secrets.AST_RND_SCANS_CLIENT_SECRET at line 25

To approve this workflow, please add the workflows-approved label to this PR.

Note: The label must be added by someone other than the PR author (cx-goncalo-lemos) or automation bots to ensure proper security review.

After the label is added, you can re-run the blocked workflow to proceed.

This workflow will be automatically approved once merged into the default branch.

For more information, see StepSecurity's Secret Exfiltration Policy documentation.

[github-actions]

⚠️ Potential secret(s) detected (unverified)

@cx-goncalo-lemos — TruffleHog found 5 potential secret(s) in this PR (0 verified, 5 unverified).

Secret Type	Status	Commit	File Path	View
Gitlab	⚠️ unverified	cd64c60f1f	engine/rules/ruledefine/gitlab_pat_routable_test.go	🔎 View secret
Gitlab	⚠️ unverified	cd64c60f1f	engine/rules/ruledefine/gitlab_pat_routable_test.go	🔎 View secret
Gitlab	⚠️ unverified	cd64c60f1f	engine/rules/ruledefine/gitlab_pat_routable_test.go	🔎 View secret
Gitlab	⚠️ unverified	cd64c60f1f	engine/rules/ruledefine/gitlab_pat_routable_test.go	🔎 View secret
Gitlab	⚠️ unverified	cd64c60f1f	engine/rules/ruledefine/gitlab_pat_routable_test.go	🔎 View secret

🛠 Guidelines to remediate hardcoded secrets

• Understand the implications of revoking this secret by investigating where it is used in your code.
• Immediately rotate/revoke the exposed secret. (https://howtorotate.com/docs/introduction/getting-started/)
• Remove it from git history ( a new "remove secret" commit is NOT enough e.g. with git-filter-repo).

To avoid such incidents in the future consider:

• Following the best practices for managing and storing secrets, including API keys and other credentials.
• Re-scan after cleanup before merging.

⚠️ These are unverified matches and do not block the merge — please review and confirm they are not real secrets.