Repository navigation
build(deps): bump github/codeql-action/analyze from 4.38.1 to 4.38.2 #835
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Security Gate: Secret Scanning" | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| branches: [main, master] | |
| permissions: {} | |
| jobs: | |
| trufflehog: | |
| name: Scan for Verified Secrets | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Resolve scan range | |
| id: scan_range | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BASE_SHA: ${{ github.event.before }} | |
| PUSH_HEAD_SHA: ${{ github.sha }} | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| run: | | |
| set -euo pipefail | |
| zero_sha="0000000000000000000000000000000000000000" | |
| if [[ "$EVENT_NAME" == "pull_request" ]]; then | |
| base="$PR_BASE_SHA" | |
| head="$PR_HEAD_SHA" | |
| else | |
| base="$PUSH_BASE_SHA" | |
| head="$PUSH_HEAD_SHA" | |
| if [[ -z "$base" || "$base" == "$zero_sha" ]]; then | |
| default_ref="origin/$DEFAULT_BRANCH" | |
| if ! git rev-parse --verify --quiet "$default_ref^{commit}" >/dev/null; then | |
| echo "::error::Cannot resolve $default_ref for push secret scan base." | |
| exit 1 | |
| fi | |
| base="$(git merge-base "$default_ref" "$head" || true)" | |
| if [[ -z "$base" || "$base" == "$head" ]]; then | |
| echo "::error::Cannot resolve a non-empty push secret scan range from $default_ref to $head." | |
| exit 1 | |
| fi | |
| fi | |
| fi | |
| echo "base=$base" >> "$GITHUB_OUTPUT" | |
| echo "head=$head" >> "$GITHUB_OUTPUT" | |
| - name: TruffleHog OSS | |
| id: trufflehog | |
| uses: trufflesecurity/trufflehog@a5f3de55cc2065ae4dde8fee24076f137fd62fcf # v3.97.8 | |
| with: | |
| path: ./ | |
| base: ${{ steps.scan_range.outputs.base }} | |
| head: ${{ steps.scan_range.outputs.head }} | |
| extra_args: --only-verified --debug | |
| - name: Notify on failure | |
| if: steps.trufflehog.outcome == 'failure' | |
| run: | | |
| echo "::error::Verified secrets found. Rotate the credential before merging." | |
| exit 1 |