41 lines
1.8 KiB
YAML
41 lines
1.8 KiB
YAML
name: security-scan
|
|
|
|
# For network tooling repos: hard-fail on real secrets (gitleaks) and committed
|
|
# key/.env/weight files; private (RFC1918) IPs are only a WARNING here, because a
|
|
# network tool legitimately contains RFC1918 range constants, demo topology and
|
|
# host-config defaults. Home/server-specific IPs are scrubbed separately.
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
secret-scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: gitleaks full scan (entropy + curated rules)
|
|
run: |
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz -o /tmp/gl.tgz
|
|
tar -xzf /tmp/gl.tgz -C /tmp gitleaks
|
|
/tmp/gitleaks detect --source . --no-banner --redact --exit-code 1
|
|
- name: key / .env / weight files
|
|
if: always()
|
|
run: |
|
|
HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true)
|
|
if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi
|
|
echo "OK: no key/.env/weight files."
|
|
- name: private IPs (warning only — network tool)
|
|
if: always()
|
|
run: |
|
|
IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
|
|
if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.sh' --exclude-dir=.git --exclude-dir=.github --exclude-dir=docs --exclude-dir=tests . ; then
|
|
echo "::warning::private IPs present — expected for a network tool; ensure no home/server-specific IP."
|
|
fi
|
|
echo "done."
|