rene.fichtmueller/PeerCortex
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CI: private-IP check -> warning (network tool; secrets+key-files stay hard gates)
All checks were successful
security-scan / secret-scan (push) Successful in 5s
Details

Browse Source
This commit is contained in:
Rene Fichtmueller (CtX) 2026-06-24 00:02:29 -01:00
parent 5f98e38845
commit 65cc203a3a
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
.github/workflows/security-scan.yml vendored
View File

@ -1,9 +1,9 @@
name: security-scan name: security-scan
# Max-heuristic, reliable push safeguard. Direct gitleaks FULL scan (entropy + # For network tooling repos: hard-fail on real secrets (gitleaks) and committed
# 150+ rules, respects .gitleaks.toml) — no partial/range scan, so force-pushes # key/.env/weight files; private (RFC1918) IPs are only a WARNING here, because a
# and history rewrites don't break it. Plus key/.env/weight-file and private-IP # network tool legitimately contains RFC1918 range constants, demo topology and
# checks (the IP check skips docs/tests/examples to avoid flagging sample IPs). # host-config defaults. Home/server-specific IPs are scrubbed separately.
on: on:
push: push:
@ -30,11 +30,11 @@ jobs:
HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true) HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true)
if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi
echo "OK: no key/.env/weight files." echo "OK: no key/.env/weight files."
- name: private IPs in code/config - name: private IPs (warning only — network tool)
if: always() if: always()
run: | run: |
IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})' IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.sh' --include='*.yaml' --include='*.yml' --exclude-dir=.git --exclude-dir=.github --exclude-dir=docs --exclude-dir=tests --exclude-dir=test --exclude-dir=__tests__ --exclude-dir=examples --exclude-dir=fixtures . ; then if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.sh' --exclude-dir=.git --exclude-dir=.github --exclude-dir=docs --exclude-dir=tests . ; then
echo "::error::private (RFC1918) IP in code/config — use 192.0.2.0/24 in examples."; exit 1 echo "::warning::private IPs present — expected for a network tool; ensure no home/server-specific IP."
fi fi
echo "OK: no private IPs in code/config." echo "done."