Repository navigation
Add a ggshield secret scan to the shared security workflow - #26
Merged
Merged
Conversation
Twenty-nine .gitguardian.yaml policy files exist across the estate and nothing ran ggshield, so not one of their exemptions was ever consulted. A policy with no reader is not a control. The key is declared optional and the job checks for it: without one the scan is skipped with a warning rather than failing. Failing closed is right for a finding -- a leaked credential must stop the build -- and wrong for a missing setting, which would paint every caller red for something none of them did. The same shape as simtabi/repo-templates' Refresh Bot credentials gate. ggshield-action is pinned to the commit of v1.56.1. Its tag is annotated, so the ref endpoint returns a tag object rather than a commit; the value here is dereferenced, which is what `uses:` resolves. This does not make the scan run anywhere yet, and the reason is worth stating: security.yml has exactly one caller in laranail/packages, package-scaffolder-old, which is superseded and has no remote. tests.yml has 39 callers and hygiene.yml has 20. Adopting security.yml is a separate change from adding a job to it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
29
.gitguardian.yamlpolicy files exist across the estate and nothing runs ggshield, so noneof their exemptions has ever been consulted. This adds the job that would read them.
It cannot turn the estate red
The key is optional and the job checks for it. Without one, the scan step is skipped with a
::warningrather than failing.Failing closed is correct for a finding — a leaked credential must stop the build — and wrong
for a missing setting, which would paint every caller red for something none of them did. Same
shape as
simtabi/repo-templates' Refresh Bot credentials gate.The part that decides whether this does anything
security.ymlhas exactly one caller, measured across 299 workflow files inlaranail/packages:tests.ymlhygiene.ymlsecurity.ymlpackage-scaffolder-old, superseded, no git remotestatic-analysis.ymlrelease.ymlSo merging this changes nothing until
security.ymlis adopted, and callers passsecrets: inherit. Adopting it is a separate change from adding a job to it, and worth doing onits own terms — two live security jobs (
composer audit, OSV) are also reaching nobody.Pin note
GitGuardian/ggshield-action'sv1.56.1is an annotated tag, sogit/ref/tagsreturns a tagobject rather than a commit. The SHA here is dereferenced (
5cc1ed2b), which is whatuses:resolves — the trap the org conventions call out by name.