Test org ruleset (will close) #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Vendored variant of Astera-org/github-workflows secret-scan.yml for the | |
| # diff-use org (Free plan: cannot call the private reusable workflow). | |
| # Synced manually; edit upstream first. | |
| name: Secret scan | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| # checks:write lets the scan jobs post a separate, NON-required check run with | |
| # conclusion=failure when findings exist. That check shows red on the PR for | |
| # visibility, but nothing requires it, so it never blocks merges. The workflow's | |
| # own (required) check stays green unless ENFORCE_CREDENTIALS is on. | |
| permissions: | |
| contents: read | |
| checks: write | |
| env: | |
| GITLEAKS_VERSION: 8.30.1 | |
| # Rollout switch (ENG-523): "false" = credential findings warn but do not | |
| # fail the check. Flip to "true" once the fleet-wide rollout is triaged. | |
| # Lives here (not a workflow_call input) because required-workflow rulesets | |
| # trigger this workflow directly, with no caller to pass inputs. | |
| ENFORCE_CREDENTIALS: "false" | |
| # Findings are announced here via chat.postMessage when the SECRET_SCAN_SLACK_BOT_TOKEN | |
| # secret is available (bot needs chat:write and to be in the channel). | |
| SLACK_CHANNEL_ID: C0BL6L7TS02 | |
| jobs: | |
| credentials: | |
| name: Credentials | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| - name: Scan full history for credentials | |
| env: | |
| SECRET_SCAN_SLACK_BOT_TOKEN: ${{ secrets.SECRET_SCAN_SLACK_BOT_TOKEN }} | |
| run: | | |
| set +e | |
| gitleaks git --redact --verbose --exit-code 2 . \ | |
| --report-format json --report-path /tmp/credentials.json | |
| status=$? | |
| set -e | |
| # exit-code 2 on findings; 0 clean; 1 reserved for scanner errors | |
| if [ "$status" -eq 2 ]; then | |
| count=$(jq length /tmp/credentials.json) | |
| { | |
| echo "## Credential findings: ${count}" | |
| echo "" | |
| echo "| Rule | File | Line | Commit |" | |
| echo "|------|------|------|--------|" | |
| jq -r '.[] | "| \(.RuleID) | \(.File) | \(.StartLine) | \(.Commit[:8]) |"' /tmp/credentials.json | head -50 | |
| echo "" | |
| echo "**What to do:**" | |
| echo "1. **Rotate the credential now.** It is compromised the moment it was pushed, even on an unmerged branch; deleting the line does not help, git history keeps it." | |
| echo "2. Put the new value in a proper secret store (GitHub Actions secret, Pulumi secret config, 1Password), not in code." | |
| echo "3. False positive, or historical and already rotated? Add the finding's fingerprint to \`.gitleaksignore\`." | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$ENFORCE_CREDENTIALS" = "true" ]; then | |
| echo "::error title=Credentials found::${count} credential finding(s) in history. Rotate and add to .gitleaksignore." | |
| exit 1 | |
| fi | |
| echo "::warning title=Credentials found (not yet enforced)::${count} credential finding(s) in history. Rotate now; this check becomes blocking soon." | |
| # Red, non-required check for visibility. Read-only token (fork PRs) | |
| # cannot create check runs; ignore the failure there. | |
| GH_TOKEN="${{ github.token }}" gh api "repos/${GITHUB_REPOSITORY}/check-runs" \ | |
| -f name="credential-findings" \ | |
| -f head_sha="${{ github.event.pull_request.head.sha || github.sha }}" \ | |
| -f status=completed -f conclusion=failure \ | |
| -f 'output[title]'="${count} credential finding(s) in git history" \ | |
| -f 'output[summary]'="Rotate the credential(s) NOW (pushed = compromised; deleting the line does not help). Details and remediation steps: see the step summary of the Secret scan workflow run. This check is informational and does not block merging." \ | |
| || echo "could not create check run (read-only token?)" | |
| if [ -n "$SECRET_SCAN_SLACK_BOT_TOKEN" ]; then | |
| curl -sf -X POST https://slack.com/api/chat.postMessage \ | |
| -H "Authorization: Bearer $SECRET_SCAN_SLACK_BOT_TOKEN" \ | |
| -H "Content-Type: application/json; charset=utf-8" \ | |
| -d "$(jq -n --arg ch "$SLACK_CHANNEL_ID" \ | |
| --arg txt ":rotating_light: *Credential leak detected* in \`${GITHUB_REPOSITORY}\` (${count} finding(s) in git history). Rotate immediately. Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \ | |
| '{channel: $ch, text: $txt}')" | jq -r '.ok // "post failed"' | |
| fi | |
| elif [ "$status" -ne 0 ]; then | |
| exit "$status" | |
| fi | |
| internal-refs: | |
| name: Internal references (warn-only) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| - name: Write internal-refs config from org secret | |
| env: | |
| GITLEAKS_INTERNAL_CONFIG: ${{ secrets.GITLEAKS_INTERNAL_CONFIG }} | |
| run: | | |
| # The pattern list enumerates internal hostnames/IP ranges, so it is | |
| # NOT embedded in this (potentially public) file. It lives in the | |
| # diff-use org-level Actions secret GITLEAKS_INTERNAL_CONFIG. | |
| if [ -z "$GITLEAKS_INTERNAL_CONFIG" ]; then | |
| echo "GITLEAKS_INTERNAL_CONFIG org secret not available (fork PR or unset); skipping internal-refs scan." | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| printf '%s' "$GITLEAKS_INTERNAL_CONFIG" > /tmp/gitleaks-internal.toml | |
| id: config | |
| - name: Scan full history for internal references | |
| if: ${{ steps.config.outputs.skip != 'true' }} | |
| env: | |
| SECRET_SCAN_SLACK_BOT_TOKEN: ${{ secrets.SECRET_SCAN_SLACK_BOT_TOKEN }} | |
| run: | | |
| set +e | |
| gitleaks git --config /tmp/gitleaks-internal.toml --verbose --exit-code 2 . \ | |
| --report-format json --report-path /tmp/internal-refs.json | |
| status=$? | |
| set -e | |
| if [ "$status" -eq 2 ]; then | |
| count=$(jq length /tmp/internal-refs.json) | |
| echo "::warning title=Internal references found::${count} internal Astera reference(s) in history. Fine for a private repo; MUST be resolved before making this repo public (see ENG-523 runbook)." | |
| { | |
| echo "## Internal references (warn-only): ${count} finding(s)" | |
| echo "" | |
| echo "| Rule | File | Line |" | |
| echo "|------|------|------|" | |
| jq -r '.[] | "| \(.RuleID) | \(.File) | \(.StartLine) |"' /tmp/internal-refs.json | head -50 | |
| echo "" | |
| echo "**What to do:** nothing, while this repo stays private. Before making it public, these must be removed or genericized, and note git history keeps old occurrences, so a repo with findings in history should be republished as a fresh single-commit repo. Intentional references (e.g. infra docs) go in \`.gitleaksignore\`." | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| GH_TOKEN="${{ github.token }}" gh api "repos/${GITHUB_REPOSITORY}/check-runs" \ | |
| -f name="internal-ref-findings" \ | |
| -f head_sha="${{ github.event.pull_request.head.sha || github.sha }}" \ | |
| -f status=completed -f conclusion=failure \ | |
| -f 'output[title]'="${count} internal Astera reference(s) in git history" \ | |
| -f 'output[summary]'="Fine while this repo is private; must be resolved before making it public. Details: see the step summary of the Secret scan workflow run. This check is informational and does not block merging." \ | |
| || echo "could not create check run (read-only token?)" | |
| if [ -n "$SECRET_SCAN_SLACK_BOT_TOKEN" ]; then | |
| curl -sf -X POST https://slack.com/api/chat.postMessage \ | |
| -H "Authorization: Bearer $SECRET_SCAN_SLACK_BOT_TOKEN" \ | |
| -H "Content-Type: application/json; charset=utf-8" \ | |
| -d "$(jq -n --arg ch "$SLACK_CHANNEL_ID" \ | |
| --arg txt ":warning: Internal Astera references in \`${GITHUB_REPOSITORY}\` (${count} in git history). Fine while private; must be resolved before the repo goes public. Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \ | |
| '{channel: $ch, text: $txt}')" | jq -r '.ok // "post failed"' | |
| fi | |
| elif [ "$status" -ne 0 ]; then | |
| echo "gitleaks failed with status $status" >&2 | |
| exit "$status" | |
| fi |