feat(secret): support new stateless format for GitHub App installation tokens (aquasecurity#10826)

Co-authored-by: ChrisJr404 <11917633+ChrisJr404@users.noreply.github.com>
Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>

Author: 3 people

pkg/fanal/secret/builtin-rules.go

@@ -140,11 +140,17 @@ var builtinRules = []Rule{
 		Keywords:        []string{"gho_"},
 	},
 	{
+		// `ghu_` user-to-server tokens keep the legacy fixed format: exactly
+		// 36 alphanumeric chars. Since 2026-04-27 `ghs_` installation
+		// tokens use a new stateless format `ghs_<APPID>_<JWT>` (~520 chars,
+		// base64url + dot-separated), so they contain `.`, `-` and `_`.
+		// GitHub recommends `ghs_[A-Za-z0-9.\-_]{36,}`. See
+		// https://github.com/aquasecurity/trivy/issues/10591.
 		ID:              "github-app-token",
 		Category:        CategoryGitHub,
 		Title:           "GitHub App Token",
 		Severity:        "CRITICAL",
-		Regex:           MustCompileWithoutWordPrefix(`?P<secret>(ghu|ghs)_[0-9a-zA-Z]{36}`),
+		Regex:           MustCompileWithoutWordPrefix(`?P<secret>(?:ghu_[0-9a-zA-Z]{36}|ghs_[0-9a-zA-Z._-]{36,})`),
 		SecretGroupName: "secret",
 		Keywords:        []string{"ghu_", "ghs_"},
 	},
@@ -608,7 +614,20 @@ var builtinRules = []Rule{
 		Category: CategoryJWT,
 		Title:    "JWT token",
 		Severity: "MEDIUM",
-		Regex:    MustCompile(`ey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/\\_-]{17,}\.(?:[a-zA-Z0-9\/\\_-]{10,}={0,2})?`),
+		// The optional `ghs_<APPID>_` prefix is part of the full match (which the
+		// allow-rule below inspects) but not of the `secret` group (which is
+		// reported). This drops the JWT embedded in a stateless GitHub App token
+		// so it is reported only once, by the `github-app-token` rule, while
+		// standalone JWTs keep matching and are reported exactly as before.
+		Regex:           MustCompile(`(?:ghs_[0-9]+_)?(?P<secret>ey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/\\_-]{17,}\.(?:[a-zA-Z0-9\/\\_-]{10,}={0,2})?)`),
+		SecretGroupName: "secret",
+		AllowRules: AllowRules{
+			{
+				ID:          "stateless-ghs-jwt",
+				Description: "Avoid double-reporting the JWT embedded in a stateless ghs_ GitHub App token",
+				Regex:       MustCompile(`^ghs_`),
+			},
+		},
 		Keywords: []string{".eyJ"},
 	},
 	{

pkg/fanal/secret/scanner_test.go

@@ -326,6 +326,28 @@ func TestSecretScanner(t *testing.T) {
 		},
 		Offset: 13,
 	}
+	wantFindingGitHubAppToken := types.SecretFinding{
+		RuleID:    "github-app-token",
+		Category:  secret.CategoryGitHub,
+		Title:     "GitHub App Token",
+		Severity:  "CRITICAL",
+		StartLine: 1,
+		EndLine:   1,
+		Match:     "GITHUB_TOKEN=**********************************************************************************************",
+		Code: types.Code{
+			Lines: []types.Line{
+				{
+					Number:      1,
+					Content:     "GITHUB_TOKEN=**********************************************************************************************",
+					Highlighted: "GITHUB_TOKEN=**********************************************************************************************",
+					IsCause:     true,
+					FirstCause:  true,
+					LastCause:   true,
+				},
+			},
+		},
+		Offset: 13,
+	}
 	wantFindingMyAwsAccessKey := types.SecretFinding{
 		RuleID:    "aws-secret-access-key",
 		Category:  secret.CategoryAWS,
@@ -1689,6 +1711,15 @@ func TestSecretScanner(t *testing.T) {
 				Findings: []types.SecretFinding{wantFindingGitHubPAT},
 			},
 		},
+		{
+			name:          "should find GitHub App installation token (stateless format)",
+			configPath:    filepath.Join("testdata", "skip-test.yaml"),
+			inputFilePath: "testdata/github-app-token.txt",
+			want: types.Secret{
+				FilePath: "testdata/github-app-token.txt",
+				Findings: []types.SecretFinding{wantFindingGitHubAppToken},
+			},
+		},
 		{
 			name:          "should enable github-pat builtin rule, but disable aws-access-key-id rule",
 			configPath:    filepath.Join("testdata", "config-enable-ghp.yaml"),

pkg/fanal/secret/testdata/github-app-token.txt

@@ -0,0 +1 @@
+GITHUB_TOKEN=ghs_15368_eyJtestHEADERdummynotreal00.eyJtestPAYLOADdummynotreal00.testSIGNATUREdummynotreal00