ci: refresh standards reusable pins to current HEAD (d7c2271) #146
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| name: Selur Secrets Detection | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| selur-scan: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 | |
| with: | |
| fetch-depth: 0 # Full history for secret scanning | |
| - name: TruffleHog Secret Scan | |
| uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3 | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| extra_args: --only-verified | |
| - name: Custom secret patterns | |
| run: | | |
| echo "::group::Custom Secret Detection" | |
| # Check for API keys in code | |
| if grep -rE "(api[_-]?key|apikey)\s*[:=]\s*['\"][a-zA-Z0-9]{20,}" extension/ --include="*.js"; then | |
| echo "::error::Potential API key found in code" | |
| exit 1 | |
| fi | |
| # Check for tokens | |
| if grep -rE "(token|access[_-]?token)\s*[:=]\s*['\"][a-zA-Z0-9._-]{20,}" extension/ --include="*.js"; then | |
| echo "::error::Potential access token found in code" | |
| exit 1 | |
| fi | |
| # Check for passwords | |
| if grep -rE "password\s*[:=]\s*['\"][^'\"]{8,}" extension/ --include="*.js"; then | |
| echo "::error::Potential hardcoded password found" | |
| exit 1 | |
| fi | |
| # Check for private keys | |
| if grep -r "BEGIN.*PRIVATE KEY" extension/; then | |
| echo "::error::Private key found in code" | |
| exit 1 | |
| fi | |
| echo "No secrets detected" | |
| echo "::endgroup::" | |
| - name: Check for sensitive file patterns | |
| run: | | |
| echo "::group::Sensitive File Detection" | |
| # Files that should not be committed | |
| sensitive_files=( | |
| "*.env" | |
| "*.pem" | |
| "*.key" | |
| ".env.local" | |
| ".env.production" | |
| "secrets.json" | |
| "credentials.json" | |
| ) | |
| found_sensitive=0 | |
| for pattern in "${sensitive_files[@]}"; do | |
| if find . -name "$pattern" -type f | grep -v node_modules; then | |
| echo "::error::Found sensitive file matching pattern: $pattern" | |
| ((found_sensitive++)) | |
| fi | |
| done | |
| if [ $found_sensitive -gt 0 ]; then | |
| exit 1 | |
| fi | |
| echo "::endgroup::" | |
| - name: Verify .gitignore coverage | |
| run: | | |
| echo "::group::GitIgnore Validation" | |
| # Patterns that should be in .gitignore | |
| required_patterns=( | |
| "*.env" | |
| "*.pem" | |
| "*.key" | |
| ".DS_Store" | |
| "node_modules" | |
| ) | |
| missing_patterns=0 | |
| for pattern in "${required_patterns[@]}"; do | |
| if ! grep -q "$pattern" .gitignore 2>/dev/null; then | |
| echo "::warning::.gitignore missing pattern: $pattern" | |
| ((missing_patterns++)) | |
| fi | |
| done | |
| echo "::endgroup::" |