Repository navigation
Scan for secrets with ggshield before anything is published (#4) - #5
Merged
Merged
Conversation
Nothing is made public before ggshield finds 0 incidents with the repository's own configuration: - .gitguardian.yaml: the full scan of 2026-11-04 found nothing, so nothing is ignored. - scripts/secret-scan.sh: the full scan of an anonymous mirror clone, including refs/pull/* and the force-pushed-away PR heads GitHub still serves. The website is the repository's content, so this covers it. The summary holds no values. - The ggshield pre-commit hook is pinned to v1.56.1's commit. - The secret scan workflow scans each push and pull request with the GITGUARDIAN_API_KEY secret, from a hash-locked install. Fork pull requests get a notice, and a manual run scans the whole history. - README.md describes the repository, which files a site sync keeps, and the rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
These changes address the review of b089ef1. - scripts/ggshield-scan.sh also scans the GitHub text: issues, pull requests, comments, reviews, release notes and commit comments. It records the API quota and gives a plain message when the branch is missing. - It fails when ggshield reports errors or "Scanning failed", even on exit 0, and when ggshield skips any file that is not binary. - A merge into main is the publication, so the README now has the full scan run before a site sync is merged. - CI drops a push base that the checkout lacks (a new branch or a force push), so ggshield scans everything not on main instead of only the tip. - The pre-commit hook runs the hash-locked ggshield from PATH. - Names now match colvenna-isle's: ggshield-scan.sh, ggshield-requirements.lock and workflows/ggshield.yml. - .gitignore keeps .cache_ggshield, which holds the latest findings, out of the repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
These changes address the second review. - scripts/ggshield-hook.sh pins the ggshield version for the pre-commit and pre-push stages. In a public repository a push is the publication, so the pre-push stage is the check before it. - scripts/ggshield-scan.sh refuses a ggshield version other than the pinned one. It scans the wiki when the wiki is enabled, and fails when an enabled wiki cannot be cloned. The repository's wiki had no page and is now disabled. A failed pull-request listing now stops the script instead of dropping reviews silently. - CI fetches a force-pushed-away base by its SHA, so only the new commits are scanned, including on main. - The README now gives the timing of publication, says which files a sync keeps, and has concrete commands for the deployment-value check. - The .gitguardian.yaml comment is re-wrapped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
) These changes address the third review. - ggshield 1.56.1 always applies default exclusions (vendor/, node_modules/, .venv/, *.mdx, *.sops, ...) without reporting them. The full scan lists every path in a history that they match, using ggshield's own matcher, and fails on any. - The wiki check reads has_wiki before testing it, so a failing gh call stops the script instead of skipping the wiki. - .gitguardian.yaml raises max_commits_for_hook to 1000. - The README calls the local hooks a best-effort check and names their limits. It says the pull-request check before a merge is a convention, since main has no rule to enforce it. It gives deployment-value commands that cover the GitHub text, ARN accounts and private IPv4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
These changes address the fourth review. - The full scan lists history paths unquoted (core.quotePath=false, -z), because git had quoted a non-ASCII path and it slipped past the default-exclusion check. - It refuses an output directory under a path the default exclusions match, since ggshield would drop every file there without notice. - The README names pre-commit's first-ref-only pre-push behaviour and lists AWS endpoint hosts for the deployment-value review. The content() helper no longer returns 1 when there is no wiki. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
main now has an active ruleset. It requires a pull request whose 'Scan for secrets with ggshield' check passes on a branch that is up to date with main, and it blocks force pushes and deletion. The README had called that check a convention. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4. Nothing here goes public before ggshield (GitGuardian's CLI) finds 0 incidents in it with the repository's own configuration. Every commit pushed here is public, and a merge into
mainpublishes the website.Changes
.gitguardian.yaml: the backfill scan found nothing, so nothing is ignored.max_commits_for_hookis 1000.scripts/ggshield-scan.sh, the full scan. It covers:refs/pull/*, plus force-pushed-away PR heads GitHub still serves); the site is the repository's content, so this covers the site too;It fails closed:
It refuses any ggshield version other than the pinned one. Its summary records no values.
Hooks:
scripts/ggshield-hook.shruns the pre-commit and pre-push hooks. It uses only the ggshield version inscripts/ggshield-requirements.lock(hash-locked, Linux arm64)..github/workflows/ggshield.ymlrunsggshield secret scan cion each push and PR, and a full-history scan when run manually..gitignorekeeps.cache_ggshieldout of the repository; the file holds the latest findings.README.mddescribes the repository and which files a site sync keeps (they are not part of the series site build). It also documents the rule:mainruleset (active): a PR whose secret scan check passes on an up-to-date branch, no force pushes, no deletion;Outside the diff, done for #4: the repository's wiki had no page and is now disabled.
Validation
shellcheckandactionlint: OK. Both hooks pass with the pinned ggshield and refuse a wrong version..gitguardian.yaml: VERDICT: CLEAN.refs/pull/*, 0 incidents;ggshieldjob: it needs theGITGUARDIAN_API_KEYActions secret, which the owner sets. Until then it fails at its last step with "secret is not set". The hash-locked install passes.🤖 Generated with Claude Code