From 2c14a5fc603fe839f7be74a26d9f7b5fcb1149e6 Mon Sep 17 00:00:00 2001 From: fisehara Date: Fri, 14 Nov 2025 09:30:35 +0100 Subject: [PATCH 1/3] Use trufflehog secret scanner before publish docker image https://balena.fibery.io/Work/Project/Scan-flowzone-build-artefacts-for-leaked-secrets-1856 Change-type: minor Signed-off-by: fisehara --- .github/workflows/flowzone.yml | 10 ++++++++++ flowzone.yml | 13 +++++++++++++ 2 files changed, 23 insertions(+) diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml index 3dfaeef96..f68c9d001 100644 --- a/.github/workflows/flowzone.yml +++ b/.github/workflows/flowzone.yml @@ -2731,6 +2731,7 @@ jobs: matrix: ${{ fromJSON(needs.is_docker.outputs.docker_test_matrix) }} env: DOCKER_BUILDKIT: "1" + TRUFFLEHOG_VERSION: 3.91.0 permissions: packages: read steps: @@ -2980,6 +2981,15 @@ jobs: if: needs.is_docker.outputs.docker_publish_matrix != '' run: | docker save ${{ join(fromJSON(steps.test_meta.outputs.json).tags,' ') }} -o ${DOCKER_TAR} + - name: Scan image tar with trufflehog + if: needs.is_docker.outputs.docker_publish_matrix != '' + run: | + docker run --rm -v ${DOCKER_TAR}:/tmp/image.tar \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + docker --image file:///tmp/image.tar --results=verified --fail + - name: Compress image tar + if: needs.is_docker.outputs.docker_publish_matrix != '' + run: | zstd -v ${DOCKER_TAR} - name: Run docker compose tests if: needs.is_docker.outputs.docker_compose_tests == 'true' diff --git a/flowzone.yml b/flowzone.yml index 511b15516..af2c5c2da 100644 --- a/flowzone.yml +++ b/flowzone.yml @@ -3183,6 +3183,8 @@ jobs: env: DOCKER_BUILDKIT: "1" + # renovate: datasource=github-releases depName=trufflesecurity/trufflehog + TRUFFLEHOG_VERSION: "3.91.0" permissions: packages: read # pull private base images from ghcr.io @@ -3321,6 +3323,17 @@ jobs: if: needs.is_docker.outputs.docker_publish_matrix != '' run: | docker save ${{ join(fromJSON(steps.test_meta.outputs.json).tags,' ') }} -o ${DOCKER_TAR} + + - name: Scan image tar with trufflehog + if: needs.is_docker.outputs.docker_publish_matrix != '' + run: | + docker run --rm -v ${DOCKER_TAR}:/tmp/image.tar \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + docker --image file:///tmp/image.tar --results=verified --fail + + - name: Compress image tar + if: needs.is_docker.outputs.docker_publish_matrix != '' + run: | zstd -v ${DOCKER_TAR} # run docker compose tests and print the logs from all services From cabe805bc92af3c5a19b896cba75b64c6679263c Mon Sep 17 00:00:00 2001 From: fisehara Date: Fri, 14 Nov 2025 13:29:49 +0100 Subject: [PATCH 2/3] Add trufflehog scanner for npm package before publish https://balena.fibery.io/Work/Project/Scan-flowzone-build-artefacts-for-leaked-secrets-1856 Change-type: minor Signed-off-by: fisehara --- .github/workflows/flowzone.yml | 16 ++++++++++++++++ flowzone.yml | 22 +++++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml index f68c9d001..6d2d0467a 100644 --- a/.github/workflows/flowzone.yml +++ b/.github/workflows/flowzone.yml @@ -2345,6 +2345,8 @@ jobs: max-parallel: ${{ fromJSON(inputs.max_parallel) }} matrix: node_version: ${{ fromJSON(needs.is_npm.outputs.node_versions) }} + env: + TRUFFLEHOG_VERSION: 3.91.0 outputs: package: ${{ steps.meta.outputs.package }} version: ${{ steps.meta.outputs.version }} @@ -2457,6 +2459,12 @@ jobs: # FIXME: workaround when `npm pack` for npm 6.x dumps tarball into the current directory because it has no `--pack-destination` flag [[ "$(npm --version)" =~ ^6\..* ]] && find . -maxdepth 1 -name '*.tgz' -exec mv {} ${{ runner.temp }}/npm-pack \; || true + - name: Scan npm package with trufflehog + if: needs.is_npm.outputs.npm_private != 'true' && needs.is_npm.outputs.max_node_version == matrix.node_version + run: | + docker run --rm -v ${{ runner.temp }}/npm-pack:/scan-target \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail - name: Upload artifact if: needs.is_npm.outputs.npm_private != 'true' && needs.is_npm.outputs.max_node_version == matrix.node_version uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 @@ -2633,6 +2641,8 @@ jobs: working-directory: . shell: bash --noprofile --norc -eo pipefail -x {0} permissions: {} + env: + TRUFFLEHOG_VERSION: 3.91.0 steps: - name: Generate GitHub App installation token uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 @@ -2660,6 +2670,12 @@ jobs: with: node-version: ${{ needs.is_npm.outputs.max_node_version }} registry-url: ${{ env.NPM_REGISTRY }} + - name: Scan final npm package release with trufflehog + run: | + pack="$(ls ${{ runner.temp }}/*/*.tgz | sort -t- -n -k3 | tail -n1)" + docker run --rm -v "${pack}":/scan-target \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail - name: Publish final release env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/flowzone.yml b/flowzone.yml index af2c5c2da..649fa4bed 100644 --- a/flowzone.yml +++ b/flowzone.yml @@ -2843,6 +2843,10 @@ jobs: matrix: node_version: ${{ fromJSON(needs.is_npm.outputs.node_versions) }} + env: + # renovate: datasource=github-releases depName=trufflesecurity/trufflehog + TRUFFLEHOG_VERSION: "3.91.0" + outputs: package: ${{ steps.meta.outputs.package }} version: ${{ steps.meta.outputs.version }} @@ -2930,6 +2934,13 @@ jobs: # FIXME: workaround when `npm pack` for npm 6.x dumps tarball into the current directory because it has no `--pack-destination` flag [[ "$(npm --version)" =~ ^6\..* ]] && find . -maxdepth 1 -name '*.tgz' -exec mv {} ${{ runner.temp }}/npm-pack \; || true + - name: Scan npm package with trufflehog + if: needs.is_npm.outputs.npm_private != 'true' && needs.is_npm.outputs.max_node_version == matrix.node_version + run: | + docker run --rm -v ${{ runner.temp }}/npm-pack:/scan-target \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail + # https://github.com/actions/upload-artifact - name: Upload artifact if: needs.is_npm.outputs.npm_private != 'true' && needs.is_npm.outputs.max_node_version == matrix.node_version @@ -3073,7 +3084,9 @@ jobs: <<: *rootWorkingDirectory permissions: {} - + env: + # renovate: datasource=github-releases depName=trufflesecurity/trufflehog + TRUFFLEHOG_VERSION: 3.91.0 steps: - <<: *getGitHubAppToken with: @@ -3102,6 +3115,13 @@ jobs: node-version: "${{ needs.is_npm.outputs.max_node_version }}" registry-url: "${{ env.NPM_REGISTRY }}" + - name: Scan final npm package release with trufflehog + run: | + pack="$(ls ${{ runner.temp }}/*/*.tgz | sort -t- -n -k3 | tail -n1)" + docker run --rm -v "${pack}":/scan-target \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail + - name: Publish final release env: # make sure to 'npm config set ignore-scripts true' to avoid leaking secrets From 945d7092036f5b9d577bf1e50d2d65dca6b50b27 Mon Sep 17 00:00:00 2001 From: fisehara Date: Fri, 14 Nov 2025 15:08:18 +0100 Subject: [PATCH 3/3] Add trufflehog to scan python package before publish Change-type: minor Signed-off-by: fisehara --- .github/workflows/flowzone.yml | 28 ++++++++++++++++++++++---- flowzone.yml | 36 ++++++++++++++++++++++++++++++---- 2 files changed, 56 insertions(+), 8 deletions(-) diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml index 6d2d0467a..7a927ab29 100644 --- a/.github/workflows/flowzone.yml +++ b/.github/workflows/flowzone.yml @@ -3831,6 +3831,8 @@ jobs: run: working-directory: ${{ inputs.working_directory }} shell: bash --noprofile --norc -eo pipefail -x {0} + env: + TRUFFLEHOG_VERSION: 3.91.0 permissions: {} steps: - name: Generate GitHub App installation token for checkout @@ -3898,14 +3900,22 @@ jobs: - name: Run poetry install run: | poetry install - - name: Publish draft release + - name: Build package + run: | + poetry version ${{ steps.python_meta.outputs.version_tag }} + poetry build + - name: Scan package with TruffleHog + run: | + docker run --rm -v "$(pwd)/dist:/scan-target" \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail + - name: Publish package env: PYPI_TOKEN: ${{ secrets.PYPI_TEST_TOKEN }} run: | - poetry version ${{ steps.python_meta.outputs.version_tag }} poetry config repositories.test-pypi https://test.pypi.org/legacy/ poetry config pypi-token.test-pypi $PYPI_TOKEN - poetry publish --build -r test-pypi + poetry publish -r test-pypi python_finalize: name: Finalize python runs-on: ${{ fromJSON(inputs.runs_on) }} @@ -3921,6 +3931,8 @@ jobs: run: working-directory: ${{ inputs.working_directory }} shell: bash --noprofile --norc -eo pipefail -x {0} + env: + TRUFFLEHOG_VERSION: 3.91.0 permissions: {} steps: - name: Generate GitHub App installation token for checkout @@ -3973,12 +3985,20 @@ jobs: uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 with: poetry-version: 1.5.1 + - name: Build package + run: | + poetry build + - name: Scan package with TruffleHog + run: | + docker run --rm -v "$(pwd)/dist:/scan-target" \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail - name: Publish release env: PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} run: | poetry config pypi-token.pypi $PYPI_TOKEN - poetry publish --build + poetry publish website_publish: name: Publish website runs-on: ${{fromJSON(inputs.runs_on)}} diff --git a/flowzone.yml b/flowzone.yml index 649fa4bed..e22eebc0e 100644 --- a/flowzone.yml +++ b/flowzone.yml @@ -3800,6 +3800,10 @@ jobs: <<: *customWorkingDirectory + env: + # renovate: datasource=github-releases depName=trufflesecurity/trufflehog + TRUFFLEHOG_VERSION: "3.91.0" + permissions: {} steps: @@ -3817,14 +3821,24 @@ jobs: run: | poetry install - - name: Publish draft release + - name: Build package + run: | + poetry version ${{ steps.python_meta.outputs.version_tag }} + poetry build + + - name: Scan package with TruffleHog + run: | + docker run --rm -v "$(pwd)/dist:/scan-target" \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail + + - name: Publish package env: PYPI_TOKEN: ${{ secrets.PYPI_TEST_TOKEN }} run: | - poetry version ${{ steps.python_meta.outputs.version_tag }} poetry config repositories.test-pypi https://test.pypi.org/legacy/ poetry config pypi-token.test-pypi $PYPI_TOKEN - poetry publish --build -r test-pypi + poetry publish -r test-pypi python_finalize: name: Finalize python @@ -3840,6 +3854,10 @@ jobs: <<: *customWorkingDirectory + env: + # renovate: datasource=github-releases depName=trufflesecurity/trufflehog + TRUFFLEHOG_VERSION: "3.91.0" + permissions: {} steps: @@ -3851,12 +3869,22 @@ jobs: - *setupPython - *setupPoetry + - name: Build package + run: | + poetry build + + - name: Scan package with TruffleHog + run: | + docker run --rm -v "$(pwd)/dist:/scan-target" \ + trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} \ + filesystem /scan-target --results=verified --fail + - name: Publish release env: PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} run: | poetry config pypi-token.pypi $PYPI_TOKEN - poetry publish --build + poetry publish ################################################### # Website