Secret Scan #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| # Blocks PRs that introduce credentials, and sweeps full history weekly | |
| # (issue #1082). | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| # Weekly full-history sweep — catches anything merged through a bypass. | |
| - cron: '0 5 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| # Full history so the scheduled run can sweep every commit, and so a | |
| # PR scan sees the whole range of pushed commits. | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'true' | |
| GITLEAKS_ENABLE_SUMMARY: 'true' | |
| fallback-scan: | |
| # The bundled scanner is what contributors run in pre-commit. Running it in | |
| # CI too keeps the two in step — a rule or allowlist change that breaks it | |
| # is caught here rather than in someone's local hook. | |
| name: Repository Scan (bundled scanner) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| - name: Scan tracked files | |
| run: node scripts/scan-secrets.js --all | |
| - name: Verify example env files hold no real values | |
| # .env.example files are allowlisted by path, so scan them explicitly | |
| # with the allowlist bypassed. | |
| run: | | |
| set -e | |
| found=0 | |
| while IFS= read -r file; do | |
| [ -z "$file" ] && continue | |
| if grep -nEi '=(eyJ[A-Za-z0-9_-]{10,}\.|sk_live_|sk_test_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,})' "$file"; then | |
| echo "::error file=$file::Example env file appears to contain a real credential" | |
| found=1 | |
| fi | |
| done < <(git ls-files '*.env.example' '*.env.sample' '*.env.template') | |
| if [ "$found" -eq 1 ]; then exit 1; fi | |
| echo "✅ Example env files contain no real credentials" |