Merge pull request #349 from AugistineCreates/feature/keyboard-naviga… #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/secrets-lint.yml | |
| # | |
| # Fails the build if any k8s/helm Secret manifest in the repo still | |
| # carries a placeholder string ("changeme", "REPLACE_ME", "yourdomain", | |
| # etc.) — i.e. someone forgot to overwrite the template before applying. | |
| # | |
| # This protects against accidentally committing a Secret with the | |
| # checked-in `changeme` default that ships in `k8s/secret.yaml`. The | |
| # fix is documented in the README of that file. | |
| name: Secrets Lint | |
| on: | |
| pull_request: | |
| paths: | |
| - "k8s/**" | |
| - "helm/**" | |
| - "monitoring/**" | |
| - ".github/workflows/secrets-lint.yml" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "k8s/**" | |
| - "helm/**" | |
| - "monitoring/**" | |
| jobs: | |
| lint-secrets: | |
| name: Fail on placeholder secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Scan k8s/helm Secret manifests for placeholders | |
| run: | | |
| set -euo pipefail | |
| # Words that should NEVER appear in a checked-in Secret. | |
| FORBIDDEN='changeme|REPLACE_ME|CHANGEME|replace-me|REPLACE-with-real-value|<your-password>|yourpassword|yourdomain\.example|CHANGEME123' | |
| HITS=$(grep -rInE "$FORBIDDEN" \ | |
| --include='*.yaml' --include='*.yml' \ | |
| k8s/ helm/ monitoring/ \ | |
| | grep -v 'secret.example.yaml' \ | |
| | grep -v 'alertmanager.yml' \ | |
| || true) | |
| if [ -n "$HITS" ]; then | |
| echo "::error::Placeholder secret values found in checked-in manifests:" | |
| echo "$HITS" | |
| exit 1 | |
| fi | |
| echo "✅ No placeholder secrets in checked-in manifests" |