Skip to content

fix(governance): TypeScript-exemption heading detection — heading-anchored, accepts common variants #483

fix(governance): TypeScript-exemption heading detection — heading-anchored, accepts common variants

fix(governance): TypeScript-exemption heading detection — heading-anchored, accepts common variants #483

Workflow file for this run

# SPDX-License-Identifier: PMPL-1.0-or-later
# Prevention workflow - scans for hardcoded secrets before they reach main
name: Secret Scanner
on:
pull_request:
push:
branches: [main]
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
trufflehog:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
with:
fetch-depth: 0 # Full history for scanning
- name: TruffleHog Secret Scan
uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3
with:
# The v3 action injects --fail automatically on pull_request events.
# Passing --fail here triggers "flag 'fail' cannot be repeated".
extra_args: --only-verified
gitleaks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
with:
fetch-depth: 0
- name: Gitleaks Secret Scan
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Rust-specific: Check for hardcoded crypto values
rust-secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
- name: Check for hardcoded secrets in Rust
run: |
if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
echo 'No Cargo.toml found — skipping Rust secrets check'
exit 0
fi
# Patterns that suggest hardcoded secrets
PATTERNS=(
'const.*SECRET.*=.*"'
'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
'const.*TOKEN.*=.*"'
'let.*api_key.*=.*"'
'HMAC.*"[a-fA-F0-9]{32,}"'
'password.*=.*"[^"]+"'
)
found=0
for pattern in "${PATTERNS[@]}"; do
if grep -rn --include="*.rs" -E "$pattern" src/; then
echo "WARNING: Potential hardcoded secret found matching: $pattern"
found=1
fi
done
if [ $found -eq 1 ]; then
echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
exit 1
fi
# Shell-specific: catch hardcoded credentials in shell scripts.
# Added 2026-05-21 after trufflehog --only-verified + gitleaks defaults
# both missed a real Cloudflare API token leaked via avow-protocol/deploy-repos.sh.
shell-secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
- name: Check for hardcoded secrets in shell scripts
run: |
# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.
PATTERNS=(
'(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'
'(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'
'(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'
'(export[[:space:]]+)?PASSWORD=["'"'"'][^"'"'"']{6,}["'"'"']'
)
found=0
for pattern in "${PATTERNS[@]}"; do
# --include covers *.sh and *.bash; add new shell extensions here if needed.
if grep -rnE --include='*.sh' --include='*.bash' \
--exclude-dir='.git' --exclude-dir='node_modules' --exclude-dir='target' \
"$pattern" . ; then
echo "::warning::Potential hardcoded secret matching: $pattern"
found=1
fi
done
if [ $found -eq 1 ]; then
echo "::error::Hardcoded secret detected in a shell script. Source from env (see avow-protocol/deploy-repos.sh) instead."
exit 1
fi