ci(deps): bump chainguard/node from 1bd1aa2 to 6b02b9b
#430
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scanning (TruffleHog) | |
| on: | |
| pull_request: | |
| branches: [master] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: secret-scanner-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| # Pin the scanner itself. Update this value through a reviewed pull request. | |
| TRUFFLEHOG_VERSION: "3.96.0" | |
| jobs: | |
| secret_scan: | |
| name: 🕵️ Secret Scanning | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden the runner (block unapproved egress) | |
| uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| fulcio.sigstore.dev:443 | |
| github.com:443 | |
| objects.githubusercontent.com:443 | |
| raw.githubusercontent.com:443 | |
| release-assets.githubusercontent.com:443 | |
| rekor.sigstore.dev:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: 'v2.6.4' | |
| - name: Install pinned TruffleHog release | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| VERSION="${TRUFFLEHOG_VERSION}" | |
| if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::Invalid pinned TruffleHog version: $VERSION" | |
| exit 1 | |
| fi | |
| BASE="https://github.com/trufflesecurity/trufflehog/releases/download/v${VERSION}" | |
| FILE="trufflehog_${VERSION}_linux_amd64.tar.gz" | |
| CHECKSUMS="trufflehog_${VERSION}_checksums.txt" | |
| for asset in \ | |
| "$FILE" \ | |
| "$CHECKSUMS" \ | |
| "${CHECKSUMS}.pem" \ | |
| "${CHECKSUMS}.sig"; do | |
| curl \ | |
| --fail \ | |
| --location \ | |
| --proto '=https' \ | |
| --proto-redir '=https' \ | |
| --retry 3 \ | |
| --show-error \ | |
| --silent \ | |
| --tlsv1.2 \ | |
| --output "$asset" \ | |
| "$BASE/$asset" | |
| done | |
| cosign verify-blob \ | |
| --certificate "${CHECKSUMS}.pem" \ | |
| --signature "${CHECKSUMS}.sig" \ | |
| --certificate-identity "https://github.com/trufflesecurity/trufflehog/.github/workflows/release.yml@refs/tags/v${VERSION}" \ | |
| --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ | |
| "$CHECKSUMS" | |
| if ! grep -Fq " $FILE" "$CHECKSUMS"; then | |
| echo "::error::Pinned archive is absent from the signed checksum manifest." | |
| exit 1 | |
| fi | |
| sha256sum --ignore-missing --strict -c "$CHECKSUMS" | |
| install -d "$RUNNER_TEMP/trufflehog-dist" "$RUNNER_TEMP/bin" | |
| tar -xzf "$FILE" -C "$RUNNER_TEMP/trufflehog-dist" trufflehog | |
| install -m 0755 "$RUNNER_TEMP/trufflehog-dist/trufflehog" "$RUNNER_TEMP/bin/trufflehog" | |
| echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" | |
| "$RUNNER_TEMP/bin/trufflehog" --version | |
| - name: Run deterministic fail-closed secret scan | |
| shell: bash | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| umask 077 | |
| RAW_REPORT="$RUNNER_TEMP/trufflehog-report.ndjson" | |
| trap 'rm -f "$RAW_REPORT"' EXIT | |
| # Verification is deliberately disabled. Under deny-all egress, online | |
| # provider verification would turn blocked requests into false negatives. | |
| # Scan only commits introduced by this pull request and treat every | |
| # detected candidate as a blocking finding for human triage. | |
| set +e | |
| trufflehog git file://. \ | |
| --since-commit "$BASE_SHA" \ | |
| --branch "$HEAD_SHA" \ | |
| --no-verification \ | |
| --results=unverified \ | |
| --json \ | |
| --no-update \ | |
| --fail \ | |
| --fail-on-scan-errors > "$RAW_REPORT" | |
| SCAN_EXIT=$? | |
| set -e | |
| case "$SCAN_EXIT" in | |
| 0|183) | |
| ;; | |
| *) | |
| echo "::error title=Secret scanner operational failure::TruffleHog exited with code $SCAN_EXIT before producing a trustworthy result." | |
| exit "$SCAN_EXIT" | |
| ;; | |
| esac | |
| if ! jq -e -s 'all(.[]; (.DetectorName | type == "string"))' "$RAW_REPORT" >/dev/null; then | |
| echo "::error title=Secret scanner operational failure::TruffleHog emitted malformed NDJSON." | |
| exit 2 | |
| fi | |
| FINDING_COUNT=$(jq -s 'length' "$RAW_REPORT") | |
| if [[ "$SCAN_EXIT" -eq 183 && "$FINDING_COUNT" -eq 0 ]]; then | |
| echo "::error title=Secret scanner operational failure::Finding exit code did not contain parseable findings." | |
| exit 2 | |
| fi | |
| if [[ "$SCAN_EXIT" -eq 0 && "$FINDING_COUNT" -ne 0 ]]; then | |
| echo "::error title=Secret scanner operational failure::Scanner returned success while emitting findings." | |
| exit 2 | |
| fi | |
| { | |
| echo "## TruffleHog pull-request scan" | |
| echo | |
| echo "- Scanner version: \`v${TRUFFLEHOG_VERSION}\`" | |
| echo "- Commit range: \`${BASE_SHA}\` to \`${HEAD_SHA}\`" | |
| echo "- Candidate count: **${FINDING_COUNT}**" | |
| if [[ "$FINDING_COUNT" -gt 0 ]]; then | |
| echo | |
| echo "### Redacted detector summary" | |
| jq -s -r \ | |
| 'sort_by(.DetectorName) | group_by(.DetectorName)[] | "- \(.[0].DetectorName): \(length)"' \ | |
| "$RAW_REPORT" | |
| echo | |
| echo "Raw values are intentionally neither logged nor uploaded. Revoke any exposed credential before removing it from Git history." | |
| fi | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| if [[ "$FINDING_COUNT" -gt 0 ]]; then | |
| echo "::error title=Potential secret material detected::${FINDING_COUNT} candidate(s) detected. Raw values were not persisted." | |
| exit 1 | |
| fi | |
| echo "No secret candidates detected in the pull-request commit range." |