MCC Release v1.6.0 Updates #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Secret Detection" | |
| on: | |
| push: | |
| branches: | |
| - "**" | |
| pull_request: | |
| # The branches below must be a subset of the branches above | |
| branches: | |
| - "**" | |
| jobs: | |
| secret-detection: | |
| name: Secret-Detection | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Upgrade tooling | |
| run: | | |
| python3 -m pip install --upgrade pip | |
| pip install detect-secrets==1.5.0 | |
| pip install jq==1.8.0 | |
| - name: Scan | |
| run: | | |
| # scripts scan repository for new secrets | |
| # backup list of known secrets | |
| cp -pr .secrets.baseline .secrets.new | |
| # find secrets in the repository | |
| detect-secrets scan --baseline .secrets.new | |
| # break build when new secrets discovered | |
| # function compares baseline/new secrets w/o listing results -- success(0) when new secret found | |
| compare_secrets() { diff <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "${1}" | sort) <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "${2}" | sort) | grep -q '>' ; } | |
| # test baseline versus new secret files | |
| if compare_secrets .secrets.baseline .secrets.new; | |
| then | |
| echo "⚠️ Attention Required! ⚠️" >&2 | |
| echo "New secrets have been detected in your recent commit. Due to security concerns, we cannot display detailed information here and we cannot proceed until this issue is resolved." >&2 | |
| echo "" >&2 | |
| echo "Please follow the steps below on your local machine to reveal and handle the secrets:" >&2 | |
| echo "" >&2 | |
| echo "1️⃣ Run the 'detect-secrets' tool on your local machine. This tool will identify and clean up the secrets:" >&2 | |
| echo "" >&2 | |
| echo " \$ detect-secrets scan --all-files --exclude-files '\.secrets\..*' --exclude-files '\.git.*' --exclude-files '\.pytest_cache' --exclude-files '\.venv' --exclude-files 'venv' --exclude-files 'dist' --exclude-files 'build' --exclude-files '.*\.egg-info' > .secrets.baseline" >&2 | |
| echo "" >&2 | |
| echo "2️⃣ Perform an audit on the updated .secrets.baseline to disposition any new findings:" >&2 | |
| echo "" >&2 | |
| echo " \$ detect-secrets audit .secrets.baseline" >&2 | |
| echo "" >&2 | |
| echo "❗NOTE: The audit tool will ask the following for all newly detected \"secrets\": \"Is this a secret that should be committed to this repository?\"" >&2 | |
| echo "" >&2 | |
| echo "❗If the detected secret is benign (i.e. a public email address or dummy password) the correct answer is \"y\"." >&2 | |
| echo "" >&2 | |
| echo "3️⃣ After auditing all new findings, commit the updated .secrets.baseline and push the update to origin." >&2 | |
| echo "" >&2 | |
| echo "Your efforts to maintain the security of our codebase are greatly appreciated!" >&2 | |
| exit 1 | |
| else | |
| echo "🟢 Secrets tests PASSED! 🟢" >&1 | |
| echo "No new secrets were detected in comparison to any baseline configurations." >&1 | |
| exit 0 | |
| fi |