detect-secrets.yaml

name: "Secret Detection"
on:
  push:
    branches: [main]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [main]

jobs:
  secret-detection:
    name: Secret-Detection
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Upgrade tooling
      run: |
        python3 -m pip install --upgrade pip
        pip install detect-secrets==1.5.0
        pip install jq==1.8.0
    - name: Scan
      run: |
        # scripts scan repository for new secrets
        # backup list of known secrets
        cp -pr .secrets.baseline .secrets.new
        # find secrets in the repository
        detect-secrets scan --baseline .secrets.new
        # break build when new secrets discovered
        # function compares baseline/new secrets w/o listing results -- success(0) when new secret found
        compare_secrets() { diff <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "${1}" | sort) <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "${2}" | sort) | grep -q '>' ; }
        # test baseline versus new secret files
        if compare_secrets .secrets.baseline .secrets.new; 
        then
            echo "⚠️ Attention Required! ⚠️" >&2
            echo "New secrets have been detected in your recent commit. Due to security concerns, we cannot display detailed information here and we cannot proceed until this issue is resolved." >&2
            echo "" >&2
            echo "Please follow the steps below on your local machine to reveal and handle the secrets:" >&2
            echo "" >&2
            echo "1️⃣ Run the 'detect-secrets' tool on your local machine. This tool will identify and clean up the secrets:" >&2
            echo "" >&2
            echo "    \$ detect-secrets scan --all-files --exclude-files '\.secrets\..*' --exclude-files '\.git.*' --exclude-files '\.pytest_cache' --exclude-files '\.venv' --exclude-files 'venv' --exclude-files 'dist' --exclude-files 'build' --exclude-files '.*\.egg-info' > .secrets.baseline" >&2
            echo "" >&2
            echo "2️⃣ Perform an audit on the updated .secrets.baseline to disposition any new findings:" >&2
            echo "" >&2
            echo "    \$ detect-secrets audit .secrets.baseline" >&2
            echo "" >&2
            echo "❗NOTE: The audit tool will ask the following for all newly detected \"secrets\": \"Is this a secret that should be committed to this repository?\"" >&2
            echo "" >&2
            echo "❗If the detected secret is benign (i.e. a public email address or dummy password) the correct answer is \"y\"." >&2
            echo "" >&2
            echo "3️⃣ After auditing all new findings, commit the updated .secrets.baseline and push the update to origin." >&2
            echo "" >&2
            echo "Your efforts to maintain the security of our codebase are greatly appreciated!" >&2
            exit 1
        else
            echo "🟢 Secrets tests PASSED! 🟢" >&1
            echo "No new secrets were detected in comparison to any baseline configurations."  >&1
            exit 0
        fi