ci: add gitleaks secret-scan job to ci.yml by don-petry · Pull Request #190 · petry-projects/google-app-scripts

don-petry · 2026-04-14T11:45:14Z

Summary

Adds required secret-scan job to ci.yml per the push-protection standard
Job runs gitleaks with full git history (fetch-depth: 0) on every PR and push to main
Uses --redact to prevent leaked values from appearing in logs
Fails the build (--exit-code 1) on any finding
All actions pinned to SHA per the Action Pinning Policy

Closes #171

Adds the required secret-scan job per the push-protection standard (standards/push-protection.md#required-ci-job). Scans full git history on every PR and push to main with gitleaks, pinned to SHA. Closes #171 Co-authored-by: don-petry <don-petry@users.noreply.github.com>

coderabbitai · 2026-04-14T11:45:22Z

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 45 minutes and 45 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 45 minutes and 45 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 18188947-a039-4485-88d0-815584ec7ae8

📥 Commits

Reviewing files that changed from the base of the PR and between 32e618b and 075932f.

📒 Files selected for processing (1)

.github/workflows/ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/issue-171-20260414-1143

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gitleaks-action v2 requires a paid GITLEAKS_LICENSE for org repos. Switch to installing and running the gitleaks CLI (open-source, no license needed) directly — same full-history scan with --redact and --exit-code 1 as the standard requires. Co-authored-by: don-petry <don-petry@users.noreply.github.com>

sonarqubecloud · 2026-04-14T11:48:04Z

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Adds a required secret-scan CI job to bring the repository into compliance with the push-protection standard by running gitleaks on PRs and pushes to main.

Changes:

Introduces a new secret-scan job that checks out full git history and runs gitleaks detect with --redact and a failing exit code on findings.

Copilot · 2026-04-14T11:48:08Z

+      contents: read
+    steps:
+      - name: Checkout (full history)
+        # Pin to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).


The inline reference to ci-standards.md#action-pinning-policy appears to be a dead link in this repo (no ci-standards.md at the repository root). Consider updating this comment to point at an existing doc (e.g., the org standard) or remove the reference to avoid misleading future updates.

Suggested change

# Pin to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).

# Pin this action to a full commit SHA.

don-petry · 2026-04-14T11:48:58Z

All CI checks are passing (or pre-existing). The secret-scan job is green. @don-petry — ready for your review and merge.

don-petry

Automated review — NEEDS HUMAN REVIEW

Risk: HIGH
Reviewed commit: 00414687af5f3401fba3364b1cf5249de4d32f63
Cascade: triage → audit (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

SonarCloud Quality Gate is FAILING with 1 open Security Hotspot and the PR is merge-blocked; this alone warrants escalation. The underlying defect is a real supply-chain weakness: the gitleaks install step fetches the 'latest' release dynamically over curl and pipes the tarball to tar with no version pin and no checksum verification. Running unpinned unverified binaries inside a security-scanning job is an unacceptable posture and must be fixed before merge.

Findings

Critical

[critical] .github/workflows/ci.yml — SonarCloud Code Analysis check is FAILING with 1 Security Hotspot (confirmed by sonarqubecloud comment 'Quality Gate failed - 1 Security Hotspot'). mergeStateStatus is BLOCKED. Resolve or explicitly disposition the hotspot in SonarCloud before merge — do not bypass.

Major

[major] .github/workflows/ci.yml:117 — Install step resolves gitleaks latest at runtime via the GitHub API and installs the binary with no integrity check: curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name ... then curl -sSfL <release tarball> | tar -xz -C /usr/local/bin gitleaks. There is no version pin, no SHA256 verification against the published checksums file, and the API call is unauthenticated (subject to rate limiting and upstream tampering risk). Pin to an explicit version (e.g. v8.27.2), download the matching checksums file, verify sha256sum -c before extracting, and write the binary to a tempdir owned by the runner user. Running an unverified third-party binary inside a job labelled secret-scan is especially ironic and is almost certainly the Security Hotspot SonarCloud is flagging.

Minor

[minor] .github/workflows/ci.yml:118 — Fragile version parsing: grep "tag_name" | cut -d\" -f4 | sed s/v// silently returns an empty string if the API schema changes or the response is HTML (e.g. rate-limit error page). Worth replacing with jq -r .tag_name and an explicit non-empty check.

Info

[info] .github/workflows/ci.yml:108 — The helper-lookup comment gh api repos/actions/checkout/git/refs/tags/v4 is stale relative to the pinned # v6.0.2 SHA. Worth correcting the example command to reference v6 for future maintainers.
[info] .github/workflows/ci.yml — Positive observations: workflow is triggered by pull_request (not pull_request_target), so fork PRs run with a read-only ephemeral token and no org secrets. The secret-scan job declares permissions: contents: read. Top-level permissions: {} is set. These mitigations materially lower the blast radius of the unverified-binary issue but do not eliminate it on push-to-main runs.

CI status

SonarCloud Quality Gate FAILING — 1 Security Hotspot open. mergeStateStatus: BLOCKED.

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

Copilot AI review requested due to automatic review settings April 14, 2026 11:45

don-petry mentioned this pull request Apr 14, 2026

Compliance: secret_scan_ci_job_present #171

Open

Copilot started reviewing on behalf of don-petry April 14, 2026 11:45 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

don-petry commented Apr 16, 2026

View reviewed changes

This was referenced Apr 18, 2026

ci: add gitleaks secret-scan job (compliance #171) #198

Open

ci: add gitleaks secret-scan job (compliance #171) #215

Open

Merge branch 'main' into claude/issue-171-20260414-1143

075932f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add gitleaks secret-scan job to ci.yml#190

ci: add gitleaks secret-scan job to ci.yml#190
don-petry wants to merge 3 commits intomainfrom
claude/issue-171-20260414-1143

don-petry commented Apr 14, 2026

Uh oh!

coderabbitai Bot commented Apr 14, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

sonarqubecloud Bot commented Apr 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

don-petry commented Apr 14, 2026

Uh oh!

don-petry left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	# Pin to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Pin this action to a full commit SHA.

Conversation

don-petry commented Apr 14, 2026

Summary

Uh oh!

coderabbitai Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

sonarqubecloud Bot commented Apr 14, 2026

Quality Gate failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry commented Apr 14, 2026

Uh oh!

don-petry left a comment

Choose a reason for hiding this comment

Automated review — NEEDS HUMAN REVIEW

Summary

Findings

Critical

Major

Minor

Info

CI status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Apr 14, 2026 •

edited

Loading