From 91642077f2b3e4b95e18d51f8ef7d8d9e58d1808 Mon Sep 17 00:00:00 2001
From: datle-krnl <datle@krnl.xyz>
Date: Tue, 30 Jun 2026 02:13:39 +0700
Subject: [PATCH 1/6] fix: update gitleaks sha

---
 .github/workflows/pr-security.yml | 55 ++++++++++++++++++++++--------
 .github/workflows/publish.yml     | 56 +++++++++++++++++++++++--------
 2 files changed, 83 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/pr-security.yml b/.github/workflows/pr-security.yml
index 6451856..f3878a5 100644
--- a/.github/workflows/pr-security.yml
+++ b/.github/workflows/pr-security.yml
@@ -26,6 +26,7 @@ concurrency:
 
 env:
   GITLEAKS_VERSION: "8.30.0"
+  GITLEAKS_LINUX_X64_SHA256: "79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e"  
 
 jobs:
   trivy-fs:
@@ -110,27 +111,53 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install Gitleaks CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfL "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/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}" -o "${archive}"
+          echo "${GITLEAKS_LINUX_X64_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "${archive}" gitleaks
+          sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
+
       - name: Run Gitleaks SARIF scan
         id: gitleaks_scan
         continue-on-error: true
-        uses: gitleaks/gitleaks-action@v2
+        shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
-          GITLEAKS_CONFIG: .gitleaks.toml
-          GITLEAKS_VERSION: ${{ env.GITLEAKS_VERSION }}
-          GITLEAKS_ENABLE_COMMENTS: "false"
-          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
-
-      - name: Ensure Gitleaks SARIF exists
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+          PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          log_opts="-1"
+          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" && -n "${PULL_REQUEST_BASE_SHA}" ]]; then
+            log_opts="${PULL_REQUEST_BASE_SHA}..HEAD"
+          elif [[ "${GITHUB_EVENT_NAME}" == "push" && -n "${PUSH_BEFORE_SHA}" && ! "${PUSH_BEFORE_SHA}" =~ ^0+$ ]]; then
+            log_opts="${PUSH_BEFORE_SHA}..HEAD"
+          fi
+          gitleaks git . \
+            --config .gitleaks.toml \
+            --log-opts "${log_opts}" \
+            --report-format sarif \
+            --report-path results.sarif \
+            --redact \
+            --exit-code 1 \
+            --no-banner
+
+      - name: Ensure Gitleaks SARIF file exists
         if: always()
         shell: bash
         run: |
-          if [ ! -s results.sarif ]; then
-            cat > results.sarif <<'JSON'
+          if [ -f results.sarif ]; then
+            exit 0
+          fi
+
+          cat > results.sarif <<'EOF'
           {
-            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
             "version": "2.1.0",
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
             "runs": [
               {
                 "tool": {
@@ -144,8 +171,8 @@ jobs:
               }
             ]
           }
-          JSON
-          fi
+          EOF
+
 
       - name: Upload Gitleaks SARIF to GitHub Security
         if: always()
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9bef58d..07577fe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -18,6 +18,7 @@ env:
   SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
   SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
   GITLEAKS_VERSION: "8.30.0"
+  GITLEAKS_LINUX_X64_SHA256: "79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e"  
 
 jobs:
   release-governance:
@@ -199,27 +200,53 @@ jobs:
           path: trivy-release-results.sarif
           if-no-files-found: error
 
+      - name: Install Gitleaks CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfL "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/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}" -o "${archive}"
+          echo "${GITLEAKS_LINUX_X64_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "${archive}" gitleaks
+          sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
+
       - name: Run Gitleaks SARIF scan
         id: gitleaks_scan
         continue-on-error: true
-        uses: gitleaks/gitleaks-action@v2
+        shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
-          GITLEAKS_CONFIG: .gitleaks.toml
-          GITLEAKS_VERSION: ${{ env.GITLEAKS_VERSION }}
-          GITLEAKS_ENABLE_COMMENTS: "false"
-          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
-
-      - name: Ensure Gitleaks SARIF exists
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+          PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          log_opts="-1"
+          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" && -n "${PULL_REQUEST_BASE_SHA}" ]]; then
+            log_opts="${PULL_REQUEST_BASE_SHA}..HEAD"
+          elif [[ "${GITHUB_EVENT_NAME}" == "push" && -n "${PUSH_BEFORE_SHA}" && ! "${PUSH_BEFORE_SHA}" =~ ^0+$ ]]; then
+            log_opts="${PUSH_BEFORE_SHA}..HEAD"
+          fi
+          gitleaks git . \
+            --config .gitleaks.toml \
+            --log-opts "${log_opts}" \
+            --report-format sarif \
+            --report-path results.sarif \
+            --redact \
+            --exit-code 1 \
+            --no-banner
+
+      - name: Ensure Gitleaks SARIF file exists
         if: always()
         shell: bash
         run: |
-          if [ ! -s results.sarif ]; then
-            cat > results.sarif <<'JSON'
+          if [ -f results.sarif ]; then
+            exit 0
+          fi
+
+          cat > results.sarif <<'EOF'
           {
-            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
             "version": "2.1.0",
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
             "runs": [
               {
                 "tool": {
@@ -233,8 +260,9 @@ jobs:
               }
             ]
           }
-          JSON
-          fi
+          EOF
+
+
 
       - name: Upload Gitleaks SARIF to GitHub Security
         if: always()

From fef9b43e0f7a1f25186cf61dabcc46e99ba8d095 Mon Sep 17 00:00:00 2001
From: datle-krnl <datle@krnl.xyz>
Date: Tue, 30 Jun 2026 02:18:20 +0700
Subject: [PATCH 2/6] feat: add trivyignore file

---
 .trivyignore | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..e048dd5
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,6 @@
+# Ignore specific paths
+tests/
+docs/
+*.test.py
+examples/
+test-agent/
\ No newline at end of file

From 509110fdc331469a5a9463a495a63c2fd73365b7 Mon Sep 17 00:00:00 2001
From: datle-krnl <datle@krnl.xyz>
Date: Tue, 30 Jun 2026 22:43:50 +0700
Subject: [PATCH 3/6] fix: update trivy & gitleaks scan output workflow summary

---
 .github/workflows/pr-security.yml             | 29 +++++++++++++++--
 .../workflows/{publish.yml => release.yml}    | 31 ++++++++++++++++---
 2 files changed, 52 insertions(+), 8 deletions(-)
 rename .github/workflows/{publish.yml => release.yml} (93%)

diff --git a/.github/workflows/pr-security.yml b/.github/workflows/pr-security.yml
index f3878a5..e72cc66 100644
--- a/.github/workflows/pr-security.yml
+++ b/.github/workflows/pr-security.yml
@@ -49,7 +49,9 @@ jobs:
         continue-on-error: true
         shell: bash
         run: |
-          set -euo pipefail
+          echo "### Trivy Filesystem Scan Results 🛡️" >> $GITHUB_STEP_SUMMARY
+          echo '```text' >> $GITHUB_STEP_SUMMARY
+          
           trivy fs . \
             --scanners vuln,misconfig \
             --vuln-type os,library \
@@ -57,7 +59,11 @@ jobs:
             --severity HIGH,CRITICAL \
             --include-dev-deps \
             --format table \
-            --exit-code 1
+            --exit-code 1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
+            
+          echo '```' >> $GITHUB_STEP_SUMMARY
+        
+          exit ${EXIT_CODE:-0}
 
       - name: Run Trivy filesystem scan for SARIF
         id: trivy_sarif
@@ -131,12 +137,18 @@ jobs:
           PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           set -euo pipefail
+
           log_opts="-1"
           if [[ "${GITHUB_EVENT_NAME}" == "pull_request" && -n "${PULL_REQUEST_BASE_SHA}" ]]; then
             log_opts="${PULL_REQUEST_BASE_SHA}..HEAD"
           elif [[ "${GITHUB_EVENT_NAME}" == "push" && -n "${PUSH_BEFORE_SHA}" && ! "${PUSH_BEFORE_SHA}" =~ ^0+$ ]]; then
             log_opts="${PUSH_BEFORE_SHA}..HEAD"
           fi
+          
+          echo "### Gitleaks Git Scan Results 🕵️‍♂️" >> $GITHUB_STEP_SUMMARY
+          echo '```text' >> $GITHUB_STEP_SUMMARY
+          
+          EXIT_CODE=0
           gitleaks git . \
             --config .gitleaks.toml \
             --log-opts "${log_opts}" \
@@ -144,7 +156,18 @@ jobs:
             --report-path results.sarif \
             --redact \
             --exit-code 1 \
-            --no-banner
+            --no-color \
+            --no-banner 2>&1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
+            
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          
+          if [ $EXIT_CODE -eq 0 ]; then
+            echo "**Result:** No leaks detected ✅" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Result:** Potential secrets detected ❌" >> $GITHUB_STEP_SUMMARY
+          fi
+          
+          exit $EXIT_CODE
 
       - name: Ensure Gitleaks SARIF file exists
         if: always()
diff --git a/.github/workflows/publish.yml b/.github/workflows/release.yml
similarity index 93%
rename from .github/workflows/publish.yml
rename to .github/workflows/release.yml
index 07577fe..520bab7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/release.yml
@@ -157,7 +157,9 @@ jobs:
         continue-on-error: true
         shell: bash
         run: |
-          set -euo pipefail
+          echo "### Trivy Filesystem Scan Results 🛡️" >> $GITHUB_STEP_SUMMARY
+          echo '```text' >> $GITHUB_STEP_SUMMARY
+          
           trivy fs . \
             --scanners vuln,misconfig \
             --vuln-type os,library \
@@ -165,8 +167,11 @@ jobs:
             --severity HIGH,CRITICAL \
             --include-dev-deps \
             --format table \
-            --exit-code 1
-
+            --exit-code 1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
+            
+          echo '```' >> $GITHUB_STEP_SUMMARY
+        
+          exit ${EXIT_CODE:-0}
       - name: Run Trivy filesystem scan for SARIF
         id: trivy_sarif
         if: always()
@@ -209,7 +214,6 @@ jobs:
           echo "${GITLEAKS_LINUX_X64_SHA256}  ${archive}" | sha256sum -c -
           tar -xzf "${archive}" gitleaks
           sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
-
       - name: Run Gitleaks SARIF scan
         id: gitleaks_scan
         continue-on-error: true
@@ -220,12 +224,18 @@ jobs:
           PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           set -euo pipefail
+
           log_opts="-1"
           if [[ "${GITHUB_EVENT_NAME}" == "pull_request" && -n "${PULL_REQUEST_BASE_SHA}" ]]; then
             log_opts="${PULL_REQUEST_BASE_SHA}..HEAD"
           elif [[ "${GITHUB_EVENT_NAME}" == "push" && -n "${PUSH_BEFORE_SHA}" && ! "${PUSH_BEFORE_SHA}" =~ ^0+$ ]]; then
             log_opts="${PUSH_BEFORE_SHA}..HEAD"
           fi
+          
+          echo "### Gitleaks Git Scan Results 🕵️‍♂️" >> $GITHUB_STEP_SUMMARY
+          echo '```text' >> $GITHUB_STEP_SUMMARY
+          
+          EXIT_CODE=0
           gitleaks git . \
             --config .gitleaks.toml \
             --log-opts "${log_opts}" \
@@ -233,7 +243,18 @@ jobs:
             --report-path results.sarif \
             --redact \
             --exit-code 1 \
-            --no-banner
+            --no-color \
+            --no-banner 2>&1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
+            
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          
+          if [ $EXIT_CODE -eq 0 ]; then
+            echo "**Result:** No leaks detected ✅" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Result:** Potential secrets detected ❌" >> $GITHUB_STEP_SUMMARY
+          fi
+          
+          exit $EXIT_CODE
 
       - name: Ensure Gitleaks SARIF file exists
         if: always()

From 4dd9aa9b75f1823e0ece5d3578fc106ce92a260a Mon Sep 17 00:00:00 2001
From: datle-krnl <datle@krnl.xyz>
Date: Tue, 30 Jun 2026 22:54:30 +0700
Subject: [PATCH 4/6] feat: add trivy ignorefile

---
 .github/workflows/pr-security.yml | 2 ++
 .github/workflows/release.yml     | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/pr-security.yml b/.github/workflows/pr-security.yml
index e72cc66..b064791 100644
--- a/.github/workflows/pr-security.yml
+++ b/.github/workflows/pr-security.yml
@@ -58,6 +58,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --include-dev-deps \
+            --ignorefile .trivyignore \               
             --format table \
             --exit-code 1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
             
@@ -78,6 +79,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --include-dev-deps \
+            --ignorefile .trivyignore \               
             --format sarif \
             --output trivy-fs-results.sarif \
             --exit-code 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 520bab7..3ba5682 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -165,7 +165,9 @@ jobs:
             --vuln-type os,library \
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
+            --ignorefile .trivyignore \               
             --include-dev-deps \
+            
             --format table \
             --exit-code 1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
             
@@ -185,6 +187,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --include-dev-deps \
+            --ignorefile .trivyignore \               
             --format sarif \
             --output trivy-release-results.sarif \
             --exit-code 1

From 4d5d26e5728e44796b76ff7fe3b6c8fffa4022ca Mon Sep 17 00:00:00 2001
From: datle-krnl <datle@krnl.xyz>
Date: Tue, 30 Jun 2026 23:09:45 +0700
Subject: [PATCH 5/6] fix: update trivyignore syntax error

---
 .github/workflows/pr-security.yml | 4 ++--
 .github/workflows/release.yml     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-security.yml b/.github/workflows/pr-security.yml
index b064791..4ecbaa4 100644
--- a/.github/workflows/pr-security.yml
+++ b/.github/workflows/pr-security.yml
@@ -58,7 +58,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --include-dev-deps \
-            --ignorefile .trivyignore \               
+            --ignorefile .trivyignore \
             --format table \
             --exit-code 1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
             
@@ -79,7 +79,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --include-dev-deps \
-            --ignorefile .trivyignore \               
+            --ignorefile .trivyignore \
             --format sarif \
             --output trivy-fs-results.sarif \
             --exit-code 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3ba5682..725b8d1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -165,7 +165,7 @@ jobs:
             --vuln-type os,library \
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
-            --ignorefile .trivyignore \               
+            --ignorefile .trivyignore \
             --include-dev-deps \
             
             --format table \
@@ -187,7 +187,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --include-dev-deps \
-            --ignorefile .trivyignore \               
+            --ignorefile .trivyignore \
             --format sarif \
             --output trivy-release-results.sarif \
             --exit-code 1

From 87106557e7219cb94b99f2d635cba142a02a269c Mon Sep 17 00:00:00 2001
From: datle-krnl <datle@krnl.xyz>
Date: Wed, 1 Jul 2026 00:16:02 +0700
Subject: [PATCH 6/6] fix: update trivy ignore path scan

---
 .github/workflows/pr-security.yml | 2 ++
 .github/workflows/release.yml     | 2 ++
 .trivyignore                      | 9 +++------
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pr-security.yml b/.github/workflows/pr-security.yml
index 4ecbaa4..cd78896 100644
--- a/.github/workflows/pr-security.yml
+++ b/.github/workflows/pr-security.yml
@@ -59,6 +59,7 @@ jobs:
             --severity HIGH,CRITICAL \
             --include-dev-deps \
             --ignorefile .trivyignore \
+            --skip-dirs tests,docs,examples,test-agent \
             --format table \
             --exit-code 1 | tee -a $GITHUB_STEP_SUMMARY || EXIT_CODE=$?
             
@@ -80,6 +81,7 @@ jobs:
             --severity HIGH,CRITICAL \
             --include-dev-deps \
             --ignorefile .trivyignore \
+            --skip-dirs tests,docs,examples,test-agent \
             --format sarif \
             --output trivy-fs-results.sarif \
             --exit-code 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 725b8d1..9e033f8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -166,6 +166,7 @@ jobs:
             --ignore-unfixed \
             --severity HIGH,CRITICAL \
             --ignorefile .trivyignore \
+            --skip-dirs tests,docs,examples,test-agent \
             --include-dev-deps \
             
             --format table \
@@ -188,6 +189,7 @@ jobs:
             --severity HIGH,CRITICAL \
             --include-dev-deps \
             --ignorefile .trivyignore \
+            --skip-dirs tests,docs,examples,test-agent \
             --format sarif \
             --output trivy-release-results.sarif \
             --exit-code 1
diff --git a/.trivyignore b/.trivyignore
index e048dd5..d034711 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,6 +1,3 @@
-# Ignore specific paths
-tests/
-docs/
-*.test.py
-examples/
-test-agent/
\ No newline at end of file
+# Suppress specific CVE/rule IDs here, one per line. Example:
+# CVE-2023-12345
+# AVD-DS-0001