feat(security): add gitleaks secret scanning — this repo had none - #47
Merged
Conversation
An estate-wide audit of secret-scanning coverage found this repository has no
leak detection of any kind: no gitleaks, no trufflehog, nothing.
Measured across all 424 repositories: 170 had gitleaks, 73 had gitleaks plus a
leftover trufflehog step, 33 had trufflehog only, and 88 — this one among them
— had nothing at all.
Adds a caller of the estate's shared secret-scanner reusable, which runs
gitleaks over the whole working tree with --no-git and exits non-zero on a
finding, alongside its rust-secrets and shell-secrets jobs.
Two details that would fail silently if left out:
- `secrets: inherit` is REQUIRED. Without it the gitleaks action's inner
secrets.GITHUB_TOKEN is empty and the scan degrades quietly — passing
while checking less, which is the failure this campaign exists to remove.
- Where an actions.lock exists it gains a hand-authored [] entry for this
file. gh actions-lock SKIPS reusable-workflow callers, so without it the
workflow is rejected as startup_failure with no log and no check run.
Expect findings. A first run on a repository that has never been scanned may
surface real secrets, and any it finds have been exposed for as long as they
have been committed. Treat a red first run as information, not as a fault in
this change — and rotate anything it names rather than only deleting it.
The sweep re-verified from this checkout that no scanner already existed
before writing, rather than trusting the audit that selected the repo.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An estate-wide audit of secret-scanning coverage found this repository has no leak detection of any kind: no gitleaks, no trufflehog, nothing.
Measured across all 424 repositories: 170 had gitleaks, 73 had gitleaks plus a leftover trufflehog step, 33 had trufflehog only, and 88 — this one among them — had nothing at all.
Adds a caller of the estate's shared secret-scanner reusable, which runs gitleaks over the whole working tree with --no-git and exits non-zero on a finding, alongside its rust-secrets and shell-secrets jobs.
Two details that would fail silently if left out:
secrets: inheritis REQUIRED. Without it the gitleaks action's inner secrets.GITHUB_TOKEN is empty and the scan degrades quietly — passing while checking less, which is the failure this campaign exists to remove.Expect findings. A first run on a repository that has never been scanned may surface real secrets, and any it finds have been exposed for as long as they have been committed. Treat a red first run as information, not as a fault in this change — and rotate anything it names rather than only deleting it.
The sweep re-verified from this checkout that no scanner already existed before writing, rather than trusting the audit that selected the repo.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers