Repository navigation
OP-195: add secret-detection CI coverage - #71
maxsonderby wants to merge 3 commits into
Conversation
DB Cooper Database ReviewNo database impact. This PR adds a read-only CI workflow and documentation for secret detection (Gitleaks). No schema changes, migrations, queries, indexes, or data paths are modified. No database risks found. Migrations and DB-impacting changes look safe. DB review by DB Cooper | Re-run with |
Judicial ReviewAdds a well-constructed Gitleaks CI workflow with checksum-pinned binary, minimal read-only permissions, and thorough process documentation. No critical issues. One warning on audit trail completeness and one info note on a documented-but-not-yet-created file. Findings: 0 critical, 1 warnings, 1 info Data Integrity
Recommendation: Add ℹ️ INFO in
Recommendation: Create an empty Legal-Grade review by Thurgood | Re-review with |
![thurgood-bot[bot]](https://avatars.githubusercontent.com/in/2711760?s=60&v=4){kind=small}
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| "${RUNNER_TEMP}/gitleaks" git --redact=100 --no-banner --verbose . |
There was a problem hiding this comment.
WARNING: Scan results are emitted only to ephemeral CI logs. GitHub retains workflow run logs for a limited window (default 90 days). For legal-grade audit trail requirements, the raw scan output should be preserved as a permanent, immutable artifact — especially for scheduled and manual runs where findings may be triaged over time.
Suggestion: Add --report-path gitleaks-report.json (or .sarif) to the scan step, then use actions/upload-artifact to persist the report. This creates a durable, machine-readable record of what was detected and when, independent of log retention.
|
|
||
| ## Exceptions | ||
|
|
||
| Exceptions must be narrow, time-bounded, and approved by both the repository owner and Security Engineering. The linked tracking record must contain the detector/fingerprint, justification, compensating control, owner, approval, and an expiry no later than 90 days. Add only the approved fingerprint to `.gitleaksignore`. Broad path, regex, detector, or repository-wide allowlists are prohibited unless the same approval record explicitly authorizes them. Remove an exception when it expires and re-run the workflow. |
There was a problem hiding this comment.
INFO: The exception process references .gitleaksignore for approved fingerprints, but the file does not exist in the repository. This is expected since no exceptions have been approved yet, but the absence should be noted during the initial historical scan triage.
Suggestion: Create an empty .gitleaksignore with a header comment explaining the approval process, or add a note in the doc that the file will be created when the first exception is approved.
Separate command substitution from readonly declaration so set -e preserves encoder errors. Shared workflow validated with actionlint 1.7.12; failure injection exits 7 rather than incorrectly succeeding. Scanner pin, complete-history scope, redaction and failure gate are unchanged.
OP-195 — secret-detection CI coverage
Adds a read-only, checksum-pinned Gitleaks workflow that scans complete reachable Git history on pushes, pull requests, a weekly schedule, and manual dispatch. Also documents historical finding treatment and the narrow, approved exception process.
This is a detective CI control, not native GitHub push protection. This PR does not change repository settings, suppress findings, rotate credentials, or rewrite history.
main2f3c7388a0439548bd0f2aa8e572ad797e72ae0dCandidate secret values are intentionally omitted. A failing scan requires authorized finding treatment before merge; it is not a waiver or compliance claim.
OP-195 workflow correction — 2026-09-09
Current head:
ca84b61ca407a6e038b953c701b4964bcbc5f87e. The checkout credential encoder now preserves command failures; actionlint 1.7.12 and a failing-encoder reproduction pass. Scanner pin, complete-history coverage, redaction and findings gate are unchanged. Scan counts/results recorded above belong to the earlier assessed head; they are historical evidence, not a passing claim for this new head. Automatic new-head CI remains to be verified.