Repository navigation
Take the scanner's key from 1Password, not from a GitHub secret - #27
Merged
Merged
Conversation
GITGUARDIAN_API_KEY was a second GitHub secret to create, hold and rotate. Now the workflow names it with an op:// reference and fetches it at run time, and GitHub holds one credential instead: OP_SERVICE_ACCOUNT_TOKEN, scoped to the CI vault. The reference is a location rather than a value, so it belongs in this file in plain text -- it documents what the job needs, and rotating the credential behind it changes nothing here. That is the point: rotation stops being a per-repository, per-secret chore. The gate now asks whether 1Password is reachable rather than whether one key is set, and still skips with a warning rather than failing. Failing closed is right for a finding and wrong for a missing setting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follows #26. That added the ggshield job reading
GITGUARDIAN_API_KEYas a GitHub secret; thismakes 1Password the source and leaves GitHub holding one credential.
GITGUARDIAN_API_KEYOP_SERVICE_ACCOUNT_TOKENop://lineThe
op://reference is not a secret. It names a location, not a value, so it belongs in thefile in plain text and reads as documentation of what the job needs.
Unchanged
The gate still skips with a
::warningwhen the credential is absent, so this cannot reddencallers before the token exists — it now asks whether 1Password is reachable rather than whether
one key is set. Failing closed stays right for a finding and wrong for a missing setting.
What is needed to make it run
turns a CI compromise into a password-manager compromise.
OP_SERVICE_ACCOUNT_TOKEN(admin:orgscope required).GitGuardianitem in that vault with the API key incredential.secrets: inherit.Steps 1–3 involve credential values and are the owner's to run; I have not seen or handled any of
them.
Still true from #26
security.ymlhas one caller across 299 workflow files —package-scaffolder-old, superseded,no remote. Adopting it is a separate change, and the reason its existing
composer auditand OSVjobs also reach nobody.
The approach is recorded in
imanimanyara/agent-configas a rule(#6).