rene.fichtmueller/shieldx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade CI to gitleaks (entropy + curated rules, max heuristic)

Browse Source
This commit is contained in:
Rene Fichtmueller (CtX) 2026-06-23 22:36:15 -01:00
parent 709e47f1de
commit 266d45733d
1 changed files with 22 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
.github/workflows/security-scan.yml vendored
View File

@ -1,16 +1,17 @@
name: security-scan name: security-scan
# Repo-level safeguard: every push and PR is scanned for committed secrets, # Max-heuristic push safeguard (server-side). gitleaks = entropy + 150+ curated
# private IPs and key/.env files. A hit fails the check and blocks the merge. # secret rules over full history; plus key/.env/weight-file and private-IP checks.
# Patterns are generic (API-key/token/private-key formats, RFC1918 ranges) so # Any hit fails the check and blocks the merge. .gitleaks.toml allowlists confirmed
# the workflow itself carries no sensitive data. No untrusted event input is # false-positives (test fixtures, doc placeholders) per repo.
# used in run: steps (injection-safe).
on: on:
push: push:
branches: [main, master]
pull_request: pull_request:
permissions:
contents: read
jobs: jobs:
secret-scan: secret-scan:
runs-on: ubuntu-latest runs-on: ubuntu-latest
@ -18,24 +19,21 @@ jobs:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Scan for committed secrets - name: gitleaks (entropy + curated rules, full history)
run: | uses: gitleaks/gitleaks-action@v2
PAT='(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{50,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|xox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|hf_[A-Za-z0-9]{30,}|nvapi-[A-Za-z0-9_-]{20,}|glpat-[A-Za-z0-9_-]{20,})' env:
if grep -rIEn "$PAT" --exclude-dir=.git --exclude-dir=.github . ; then GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
echo "::error::Potential secret/token detected — push blocked."; exit 1 - name: key / .env / weight files
fi if: always()
echo "OK: no secret/token patterns."
- name: Scan for private IPs
run: |
IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
if grep -rIEn "$IP" --include='*.py' --include='*.json' --include='*.md' --include='*.yaml' --include='*.yml' --include='*.txt' --include='*.html' --include='*.js' --exclude-dir=.git --exclude-dir=.github . ; then
echo "::error::Private (RFC1918) IP detected — push blocked. Use 192.0.2.0/24 in examples."; exit 1
fi
echo "OK: no private IPs."
- name: Scan for secret/key/weight files
run: | run: |
HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true) HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true)
if [ -n "$HITS" ]; then if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi
echo "::error::Secret/key/weight file committed — push blocked:"; echo "$HITS"; exit 1
fi
echo "OK: no key/.env/weight files." echo "OK: no key/.env/weight files."
- name: private IPs (RFC1918)
if: always()
run: |
IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.json' --include='*.yaml' --include='*.yml' --include='*.sh' --include='*.md' --exclude-dir=.git --exclude-dir=.github . ; then
echo "::error::private (RFC1918) IP — use the 192.0.2.0/24 doc range in examples."; exit 1
fi
echo "OK: no private IPs."