Repository navigation
Add free secret-scan CI workflow template - #2293
Merged
Merged
Conversation
Opt-in templates/secret-scan.yml: gitleaks pinned by version and sha256, checkout pinned by SHA with persist-credentials false, PR scan of base..head, full-history scan on push, weekly schedule and dispatch, false positives via .gitleaksignore fingerprints (no path allowlists). No license or cost. Routed from references/review-config.md; a static test pins the properties. Tests: 7/7 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PR scans now reset .gitleaks.toml and .gitleaksignore to the base commit's copy so a PR cannot silence its own findings. The test pins the exact digest and version, least-privilege permissions, no expressions in run blocks, triggers, flags, install order, the base..head and full-history branches and the config reset, and proves each check fails on a seeded mutation. Logs the checkout v7.0.1 and gitleaks v8.30.1 releases in docs/standards-index.md. Tests: 19/19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…set-order and dash-run checks The reset comment now says it only blocks edits to the root .gitleaks.toml and .gitleaksignore; a PR editing the workflow itself can still bypass it, so protect .github/workflows/ with CODEOWNERS and required review and make the check required. The test now anchors the digest line (ends sha256sum -c -, no ||), asserts the reset precedes the PR-path scan, and matches '- run:' step form in the no-expression check, each proven by a seeded mutation. Tests: 22/22 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in, free secret-scan workflow template:
templates/secret-scan.yml..gitleaksignorefingerprints, never path allowlists.references/review-config.md;scripts/test-secret-scan-template.sh(registered in ci-tests.d) pins the properties. Tests: 7/7.Never installed by
install.sh.🤖 Generated with Claude Code