From b2356b3642b979901dd90fe4e5e003b392a1560c Mon Sep 17 00:00:00 2001 From: Pablo Garay Date: Mon, 21 Jul 2025 17:01:20 -0700 Subject: [PATCH 1/2] add_secrets_detector --- .github/workflows/config/.secrets.baseline | 146 +++++++++++++++++++++ .github/workflows/secrets-detector.yml | 36 +++++ 2 files changed, 182 insertions(+) create mode 100644 .github/workflows/config/.secrets.baseline create mode 100644 .github/workflows/secrets-detector.yml diff --git a/.github/workflows/config/.secrets.baseline b/.github/workflows/config/.secrets.baseline new file mode 100644 index 00000000..f009da85 --- /dev/null +++ b/.github/workflows/config/.secrets.baseline @@ -0,0 +1,146 @@ +{ + "version": "1.5.0", + "plugins_used": [ + { + "name": "ArtifactoryDetector" + }, + { + "name": "AWSKeyDetector" + }, + { + "name": "AzureStorageKeyDetector" + }, + { + "name": "Base64HighEntropyString", + "limit": 4.5 + }, + { + "name": "BasicAuthDetector" + }, + { + "name": "CloudantDetector" + }, + { + "name": "DiscordBotTokenDetector" + }, + { + "name": "GitHubTokenDetector" + }, + { + "name": "GitLabTokenDetector" + }, + { + "name": "HexHighEntropyString", + "limit": 3.0 + }, + { + "name": "IbmCloudIamDetector" + }, + { + "name": "IbmCosHmacDetector" + }, + { + "name": "IPPublicDetector" + }, + { + "name": "JwtTokenDetector" + }, + { + "name": "KeywordDetector", + "keyword_exclude": "" + }, + { + "name": "MailchimpDetector" + }, + { + "name": "NpmDetector" + }, + { + "name": "OpenAIDetector" + }, + { + "name": "PrivateKeyDetector" + }, + { + "name": "PypiTokenDetector" + }, + { + "name": "SendGridDetector" + }, + { + "name": "SlackDetector" + }, + { + "name": "SoftlayerDetector" + }, + { + "name": "SquareOAuthDetector" + }, + { + "name": "StripeDetector" + }, + { + "name": "TelegramBotTokenDetector" + }, + { + "name": "TwilioKeyDetector" + } + ], + "filters_used": [ + { + "path": "detect_secrets.filters.allowlist.is_line_allowlisted" + }, + { + "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies", + "min_level": 2 + }, + { + "path": "detect_secrets.filters.heuristic.is_indirect_reference" + }, + { + "path": "detect_secrets.filters.heuristic.is_likely_id_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_lock_file" + }, + { + "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_potential_uuid" + }, + { + "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign" + }, + { + "path": "detect_secrets.filters.heuristic.is_sequential_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_swagger_file" + }, + { + "path": "detect_secrets.filters.heuristic.is_templated_secret" + } + ], + "results": { + "nemo_vfm\\physicalai\\diffusion\\post_training\\multicamera\\README.md": [ + { + "type": "Secret Keyword", + "filename": "nemo_vfm\\physicalai\\diffusion\\post_training\\multicamera\\README.md", + "hashed_secret": "fc8688e409faee56de5f0f8354436fddcdc9ffad", + "is_verified": true, + "line_number": 28 + } + ], + "nemo_vfm\\physicalai\\tokenizer\\losses\\lpips.py": [ + { + "type": "Hex High Entropy String", + "filename": "nemo_vfm\\physicalai\\tokenizer\\losses\\lpips.py", + "hashed_secret": "f6aaa72555a102f3c484e29cca8ac618fc07eada", + "is_verified": false, + "line_number": 62 + } + ] + }, + "generated_at": "2025-07-21T23:52:33Z" +} diff --git a/.github/workflows/secrets-detector.yml b/.github/workflows/secrets-detector.yml new file mode 100644 index 00000000..ca5cc5ff --- /dev/null +++ b/.github/workflows/secrets-detector.yml @@ -0,0 +1,36 @@ +# Copyright (c) 2025 NVIDIA CORPORATION. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +name: Secrets detector + +on: + pull_request: + +jobs: + main: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + path: ${{ github.run_id }} + ref: ${{ inputs.branch-name || github.head_ref }} + fetch-depth: 0 + + - name: Install secrets detector + run: pip install detect-secrets + + - name: Run on change-set + run: | + cd ${{ github.run_id }} + git diff --name-only --diff-filter=d --merge-base origin/main -z | xargs -0 detect-secrets-hook --baseline .github/workflows/config/.secrets.baseline \ No newline at end of file From e51048460470a2279dc69438146548c50348f4e0 Mon Sep 17 00:00:00 2001 From: Pablo Garay Date: Tue, 22 Jul 2025 14:35:26 -0700 Subject: [PATCH 2/2] Secrets Detector made right --- .github/workflows/config/.secrets.baseline | Bin 3112 -> 6798 bytes .github/workflows/secrets-detector.yml | 4 +++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/config/.secrets.baseline b/.github/workflows/config/.secrets.baseline index f009da85eb9d99b1417381c0be5ea3ae79435a57..0f9dae8b1842feb4eb55781dcd4423d771bf849f 100644 GIT binary patch literal 6798 zcmd6sZExCE7>1wEllC7FpIg)drCGnF>(r!O*Jz0}X!5$^|#Ql2mE88dS3@=de0 z@0TTtHb3V#JGGbW8D{s-NMgb6rv(pvWHbzR-czI{x%aGVM@VmM=k^mC$)O>&IXsGv zh11fwrol=RQ@+l)^FkM0r|}XOn)fYo_LNP~+#wRlp=>eWp@x1#Jo*|bE z9)!l&p7NX98Gqj)^CZA|&z&BQ;OXrhobxks3wzEHa{9D0WOke%+7_9|@I12$JI6?2 z7C@KfIVlJ_;sp7%-6QnaPPl{@*>Q*yUf9RLsQ2FZV_{`CWmLtT%4^92FQLp^X5?@- za4{)nTt=1cD<6=LB6O&TdV-ec zNIs<3J#|uw?YZM94j`*j5G4D57i900tSNUVT*ApB$QkePF@5$P+UtN3z06jG+nau1 zThD*Su2b$Ye8}gAkLPE2D0vU%)SFpI$>W=)+_s5+wTtXb8T#$B?YXnk^DDn7A6e$r zk;@}`qF6OXR8&2xI}|yoYzxPJ__!Woe8U|38Zh0 zy|+@oO1@PcmAmy;I#ts8g!j+Dqq-wgN0r`H_0h5{S5;R&7Kx(;w&<&=dQY#4fa)^I zB2xQ{`HC=qa<%wXELJ>RmVws2slEAf^;FM!#7pMrS61R_sCN>Z&?fo&I6h*eljZL& zS>fZkG&6DU6$3|H>Qwp|?`Nw%m#^^(Lg^1Wnkqd!@iawZ}7vpZMFR>qz= znlp!3Wdaj!W%#n$bymG8UVU$`an;>xTvb q%43#sPa}`1Ci_YbkL4-j6tLk^g;^?Aqy? zcyj6&%aD#d@+0~2`+5{b@jY5cM#pDSd^|`8!}v}6wo#!Z?egGI@~2PyE{eW(zx-80 zjjh4C^;CfH#x5_=WBVuW&OEkGo-_Ds_8ay+`z2VMu}dhix6wOrI2m72SzT&xO|zVN zOSg=v0s!4614Ak`huJ=R=zX-*341&GkQ<{D%|a7 z@H^~daD@*&kQ)t#JCVD-t2;EVq3)MhYhc_}4Wj4yo11W_sORZl7yE$Bjke&*Yyw&J zG55`U^&!Uxp@QtXe|M{Y08*l&y4m>JiP|4cPqaQZsL!waIlZxT55E8O+$YfB0Z_H%xV3QG(1e#3gZAVua!+G2$M z=?JzU<(YY3AlL?c)e@}iST%PjEP6Ls8x24yvry#xfLyLfW4?LAbp31<{>P&*b!~L( zj!JDT%3KD_y~%k!P(cDb?})rHJa&X`OQ$vIT;V+`jy8GC#T5q2iIC{-){-o*k=$Z| z7PY`vCG(w6MRQckoMi4+tKg@jR7T8mF2wq3dv`)V_ge4_2lZvyQ=k$l^N?7ae4ZINJ#D#Ua$o#J?S zS^#1?k(d_4VmeC4