Uh oh!
There was an error while loading. Please reload this page.
ci: add gitleaks secret scanning - #1444
Conversation
⏱️ Aging and SLA annotation
Maintained by project-meta-sync workflow. |
✅ Template check passed after update. Thanks for fixing the PR description. |
🔍 Reviewer Summary for PR #1444CI Status: ❌ Recommendations
|
Warning Review limit reached
Next review available in:41 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds Gitleaks scanning for pull requests and manual runs. The reusable workflow supports shallow or full-history checkout, installs the latest Gitleaks release, and applies project-specific allowlists for documented example secrets. ChangesGitleaks scanning
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequestOrManualRun
participant GitleaksWorkflow
participant ReusableWorkflow
participant Gitleaks
PullRequestOrManualRun->>GitleaksWorkflow: trigger scan
GitleaksWorkflow->>ReusableWorkflow: pass full-history setting
ReusableWorkflow->>ReusableWorkflow: check out selected history
ReusableWorkflow->>Gitleaks: run scan with .gitleaks.toml
Gitleaks-->>ReusableWorkflow: return redacted scan result
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/gitleaks.yml (1)
3-3: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winAdd a boundary for pull-request runs.
Add a
branchesfilter for the protected merge branches, or document why every base branch requires this scan. The comparablereviewer.ymlworkflow targetsdevelop.This keeps routine scan runs focused without using path filters that could exclude secrets. As per path instructions, “ensure branch/path filters are present to avoid unnecessary runs”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gitleaks.yml at line 3, Add a pull_request branches filter in the gitleaks workflow, targeting the protected merge branches consistent with the repository’s branch conventions and the reviewer.yml workflow’s develop target. Keep the scan applicable to all relevant paths and avoid adding path filters that could exclude secrets.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gitleaks-reusable.yml:
- Line 14: Update .github/workflows/gitleaks-reusable.yml lines 14-14 to use
truthy string values in the full-history fetch-depth pseudo-ternary, preserving
depth 0 when inputs.full-history is true and depth 1 otherwise. Update lines
19-19 with explicit conditional shell branches so full-history runs gitleaks
detect without --no-git, while the shallow path retains --no-git --source ..
---
Nitpick comments:
In @.github/workflows/gitleaks.yml:
- Line 3: Add a pull_request branches filter in the gitleaks workflow, targeting
the protected merge branches consistent with the repository’s branch conventions
and the reviewer.yml workflow’s develop target. Keep the scan applicable to all
relevant paths and avoid adding path filters that could exclude secrets.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 66b7e038-7239-4533-8bbf-917fff0df975
📒 Files selected for processing (3)
.github/workflows/gitleaks-reusable.yml.github/workflows/gitleaks.yml.gitleaks.toml
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
⚠️ CI failures not shown inline (4)
GitHub Actions: Changelog • Management / 0_Validate changelog on PR.txt: ci: add gitleaks secret scanning
Conclusion: failure
##[group]Run actions/github-script@v7
with:
script: const cp = require("node:child_process");
const author = context.payload.pull_request?.user?.login || "";
const labels = (context.payload.pull_request?.labels || []).map((l) => l.name);
const has = (name) => labels.includes(name);
if (author === "dependabot[bot]" || author === "app/dependabot") {
core.info("Skipping changelog requirement for Dependabot pull requests.");
core.setOutput("run_validation", "false");
return;
}
if (has("meta:needs-changelog") && has("meta:no-changelog")) {
core.setFailed("PR cannot include both meta:needs-changelog and meta:no-changelog.");
return;
}
const restrictedTypes = new Set([
"type:feature",
"type:bug",
"type:performance",
"type:security",
"type:release",
"type:hotfix",
]);
if (has("meta:no-changelog") && labels.some((label) => restrictedTypes.has(label))) {
core.setFailed("meta:no-changelog is not allowed for high-impact release-related change types.");
return;
}
const baseSha = context.payload.pull_request?.base?.sha;
const headSha = context.payload.pull_request?.head?.sha;
const changed = cp
.execSync(`git diff --name-only ${baseSha} ${headSha}`, {
encoding: "utf8",
maxBuffer: 1024 * 1024 * 100,
})
.split("\n")
.filter(Boolean);
if (changed.includes("CHANGELOG.md")) {
core.info("CHANGELOG.md updated in PR diff.");
core.setOutput("run_validation", "true");
return;
}
if (has("meta:no-changelog")) {
core.info("Skipping changelog requirement due to meta:no-changelog label.");
core.setOutput("run_validation", "false");
return;
}
core.setFailed("PR requires a CHANGELOG.md update or the meta:no-changelog label.");
github-***REDACTED_SECRET_ASSIGNMENT***
debug: false
user-agent: actions/github-script
result-encoding: json
retries: 0
retry-exempt-status-codes: 400,401,403,404,422
##[endgroup]
##[error]PR requires a CHANGELOG.md update or the meta:no-changelog label.
GitHub Actions: Changelog • Management / Validate changelog on PR: ci: add gitleaks secret scanning
Conclusion: failure
##[group]Run actions/github-script@v7
with:
script: const cp = require("node:child_process");
const author = context.payload.pull_request?.user?.login || "";
const labels = (context.payload.pull_request?.labels || []).map((l) => l.name);
const has = (name) => labels.includes(name);
if (author === "dependabot[bot]" || author === "app/dependabot") {
core.info("Skipping changelog requirement for Dependabot pull requests.");
core.setOutput("run_validation", "false");
return;
}
if (has("meta:needs-changelog") && has("meta:no-changelog")) {
core.setFailed("PR cannot include both meta:needs-changelog and meta:no-changelog.");
return;
}
const restrictedTypes = new Set([
"type:feature",
"type:bug",
"type:performance",
"type:security",
"type:release",
"type:hotfix",
]);
if (has("meta:no-changelog") && labels.some((label) => restrictedTypes.has(label))) {
core.setFailed("meta:no-changelog is not allowed for high-impact release-related change types.");
return;
}
const baseSha = context.payload.pull_request?.base?.sha;
const headSha = context.payload.pull_request?.head?.sha;
const changed = cp
.execSync(`git diff --name-only ${baseSha} ${headSha}`, {
encoding: "utf8",
maxBuffer: 1024 * 1024 * 100,
})
.split("\n")
.filter(Boolean);
if (changed.includes("CHANGELOG.md")) {
core.info("CHANGELOG.md updated in PR diff.");
core.setOutput("run_validation", "true");
return;
}
if (has("meta:no-changelog")) {
core.info("Skipping changelog requirement due to meta:no-changelog label.");
core.setOutput("run_validation", "false");
return;
}
core.setFailed("PR requires a CHANGELOG.md update or the meta:no-changelog label.");
github-***REDACTED_SECRET_ASSIGNMENT***
debug: false
user-agent: actions/github-script
result-encoding: json
retries: 0
retry-exempt-status-codes: 400,401,403,404,422
##[endgroup]
##[error]PR requires a CHANGELOG.md update or the meta:no-changelog label.
GitHub Actions: Validate PR Template / 0_validate-pr-template.txt: ci: add gitleaks secret scanning
Conclusion: failure
##[group]Run actions/github-script@v7
with:
script: const { validatePullRequestBody } = require('./scripts/validation/template-helpers.cjs');
const marker = '<!-- template-enforcement -->';
const pr = context.payload.pull_request;
const author = pr.user?.login || '';
const isDependabot = author === 'dependabot[bot]' || author === 'app/dependabot';
const isImgbot = author === 'imgbot[bot]' || author === 'app/imgbot';
if (isDependabot || isImgbot) {
core.info(`Skipping PR template validation for bot author ${author}.`);
return;
}
const validation = validatePullRequestBody(pr.body || '', pr.labels || [], pr.head?.ref || '');
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
per_page: 100
});
const previous = comments.find((comment) =>
comment.user?.type === 'Bot' && comment.body?.includes(marker)
);
if (validation.missing.length === 0) {
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: `${marker}\n✅ Template check passed after update. Thanks for fixing the PR description.`
});
}
return;
}
const message = [
marker,
'🚫 This PR description is missing required template content.',
'',
`Missing required section(s): ${validation.missing.join(', ')}`,
'',
'Please update the PR body using one of the repository PR templates:',
'- https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md',
'- https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE',
'',
'Empty placeholders, unchecked checklist boxes, and stub issue references do not count.'
].join('\n');
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: message
});
} else {
await github.rest.issues....
GitHub Actions: Validate PR Template / validate-pr-template: ci: add gitleaks secret scanning
Conclusion: failure
##[group]Run actions/github-script@v7
with:
script: const { validatePullRequestBody } = require('./scripts/validation/template-helpers.cjs');
const marker = '<!-- template-enforcement -->';
const pr = context.payload.pull_request;
const author = pr.user?.login || '';
const isDependabot = author === 'dependabot[bot]' || author === 'app/dependabot';
const isImgbot = author === 'imgbot[bot]' || author === 'app/imgbot';
if (isDependabot || isImgbot) {
core.info(`Skipping PR template validation for bot author ${author}.`);
return;
}
const validation = validatePullRequestBody(pr.body || '', pr.labels || [], pr.head?.ref || '');
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
per_page: 100
});
const previous = comments.find((comment) =>
comment.user?.type === 'Bot' && comment.body?.includes(marker)
);
if (validation.missing.length === 0) {
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: `${marker}\n✅ Template check passed after update. Thanks for fixing the PR description.`
});
}
return;
}
const message = [
marker,
'🚫 This PR description is missing required template content.',
'',
`Missing required section(s): ${validation.missing.join(', ')}`,
'',
'Please update the PR body using one of the repository PR templates:',
'- https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md',
'- https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE',
'',
'Empty placeholders, unchecked checklist boxes, and stub issue references do not count.'
].join('\n');
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: message
});
} else {
await github.rest.issues....
🧰 Additional context used
📓 Path-based instructions (1)
**/.github/workflows/*.yml
⚙️ CodeRabbit configuration file
**/.github/workflows/*.yml: Review GitHub Actions workflows for this governance repo:
- Security: check for least-privilege permissions (use
permissions:at job level, default to read-only).- Secret handling: ensure secrets are passed via env vars, not interpolated directly into run: steps to prevent injection.
- Action pinning: prefer SHA-pinned actions over mutable tags (e.g.
actions/checkout@v4is acceptable; SHA pins are better).- No
pull_request_targetwith untrusted code execution unless explicitly justified.- Avoid storing sensitive outputs as unmasked step outputs.
- Check for reusable workflow patterns and matrix strategies where appropriate.
- Validate
on:triggers: ensure branch/path filters are present to avoid unnecessary runs.- Confirm workflows are documented, DRY, and maintainable.
- Ensure agent-triggered workflows use
workflow_dispatchwith defined inputs.
Files:
.github/workflows/gitleaks.yml.github/workflows/gitleaks-reusable.yml
🪛 zizmor (1.28.0)
.github/workflows/gitleaks-reusable.yml
[warning] 12-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 14-14: unsound pseudo-ternary expression (unsound-ternary): pseudo-ternary has falsy true value
(unsound-ternary)
[warning] 19-19: unsound pseudo-ternary expression (unsound-ternary): pseudo-ternary has falsy true value
(unsound-ternary)
🔇 Additional comments (3)
.gitleaks.toml (1)
1-16: LGTM!.github/workflows/gitleaks-reusable.yml (1)
1-7: LGTM!.github/workflows/gitleaks.yml (1)
4-13: LGTM!
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Build/CI Pull Request
Linked issues
Closes#1445
Build/CI change
gitleaks-reusable.yml(aworkflow_callreusable workflow for organisation-wide use) andgitleaks.yml(this repository's caller, running on pull requests intodevelop/mainand onworkflow_dispatch). Adds.gitleaks.toml.gitleaks-actionwrapper requires a paid licence for organisation repositories, so this invokes the open-source Gitleaks CLI directly — the same approach already used inlightspeed-hosting-infra.Baseline & Target
workflow_dispatchacceptsfull-history: truefor an on-demand full-history rescan.Rollback
Revert this PR. The workflows are additive and nothing else depends on them.
Notes
sk_live_abc123…, a doc-labelled mock key, and Figma file-key examples matched by the generic-api-key rule). No live credentials were found and none require rotation; all are allowlisted in.gitleaks.toml.Changelog
Added
Changed
Fixed
Removed
Checklist (Global DoD / PR)
--redact