Conversation
Add the required `secret-scan` job per the push-protection standard (standards/push-protection.md#required-ci-job). The job runs gitleaks in full-history mode on every PR and push to main, with --redact to prevent leaked values appearing in logs and --exit-code 1 to fail CI on any finding. Both actions are SHA-pinned per the Action Pinning Policy. Co-authored-by: don-petry <don-petry@users.noreply.github.com>
📝 WalkthroughWalkthroughThis PR introduces secret scanning to the CI pipeline by adding a new Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
gitleaks-action v2 requires a GITLEAKS_LICENSE for org repos. Switch to installing the gitleaks binary (v8.30.1) directly and running `gitleaks detect` with the same flags required by the standard: --redact (prevent secret values in logs) and --exit-code 1 (fail CI on any finding). Full history is still scanned via fetch-depth: 0. Co-authored-by: don-petry <don-petry@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR brings the repository into push-protection compliance by adding a required secret-scan CI job that runs Gitleaks on every PR and push to main, failing the workflow if secrets are detected while redacting leaked values from logs.
Changes:
- Add a new
secret-scanjob to the main CI workflow. - Configure the job to fetch full git history and run
gitleaks detectwith redaction and failing exit code behavior. - Use SHA-pinned GitHub Actions for checkout and Gitleaks execution.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The secret-scan job flags 7 findings in commit 865de69, all in BMAD config/knowledge files. Each match is a documentation file path containing "api-key" or "api-request" as part of the path string, not an actual credential. Fingerprints are added to .gitleaksignore per the gitleaks documentation for false-positive suppression. Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
|
@don-petry — CI is green for the secret-scan job. This PR adds the required |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 142-147: Update the "Install gitleaks" step to verify the
downloaded tarball using its SHA256 checksum before moving the binary to
/usr/local/bin: download the corresponding gitleaks SHA256SUM or checksum file
from the same release (matching v8.30.1), compute the checksum of the fetched
tar.gz (the curl/tar sequence used in the Install gitleaks step), compare them
and fail the job if they differ, and only on a successful match extract the
gitleaks binary and run sudo mv gitleaks /usr/local/bin/gitleaks; ensure the
verification logic is implemented inline in the Install gitleaks run block so
the action aborts on mismatch.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 37d33853-1c31-498f-8140-b1b877d6058c
📒 Files selected for processing (2)
.github/workflows/ci.yml.gitleaksignore
| - name: Install gitleaks | ||
| run: | | ||
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz" \ | ||
| | tar -xz gitleaks | ||
| sudo mv gitleaks /usr/local/bin/gitleaks | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
version="8.30.1"
base="https://github.com/gitleaks/gitleaks/releases/download/v${version}"
asset="gitleaks_${version}_linux_x64.tar.gz"
# Verify checksum entry exists for this asset in upstream release metadata.
curl -sSfL "$base/checksums.txt" | grep -E " ${asset}$"Repository: petry-projects/markets
Length of output: 114
🌐 Web query:
gitleaks v8.30.1 release checksums artifact
💡 Result:
The Gitleaks v8.30.1 release was published on March 21, 2026, by zricethezav on GitHub (https://github.com/gitleaks/gitleaks/releases/latest or https://github.com/gitleaks/gitleaks/releases/tag/v8.30.1). It includes 13 binary assets for various platforms (Darwin, Linux, Windows; arm64, x64, etc.), with sizes ranging from 999 Bytes to 7.85 MB. Checksums (SHA256) for the artifacts, as listed in the release page: - 061476c21adaf5441516f96f185c1a4706a83cd6329b9b38762271b3d4a52fae (999 Bytes, 2026-03-21T02:17:03Z) - likely gitleaks_8.30.1_checksums.txt - b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5 (7.53 MB, 2026-03-21T02:13:43Z) - dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709 (7.97 MB, 2026-03-21T02:13:43Z) - e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080 (7.25 MB, 2026-03-21T02:13:43Z) - 5c2a4ee657a27614e10352bed2b8f1018ef9b05fc6c037cf737776bbe1255766 (7.17 MB, 2026-03-21T02:13:43Z) - 8d39f0d94ba0d774b2282187656fb039a2d82893ec1fd6be7d7121aae759a57d (7.15 MB, 2026-03-21T02:13:43Z) - a87ba11adab22b4d6c6ea28b2da60f09154d5c2fdb44d4b07015d1e0433daecb (7.28 MB, 2026-03-21T02:17:00Z) - 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb (7.85 MB, 2026-03-21T02:13:43Z) - b95f5e4f5c425cedca7ee203d9afd29597e692c4924a12ed42f970537c72cc0f (7.35 MB, 2026-03-21T02:13:43Z) - 190ad53db301eec3e90afe3a1a75270768b8ebf89e731345e19421c32c1ae1a1 (7.55 MB, 2026-03-21T02:13:43Z) The full content of gitleaks_8.30.1_checksums.txt is not directly available in search snippets, but it can be downloaded from the release assets. This release addresses issues like unnecessary functions in report templates and updates GoReleaser and Go to 1.24. Note: There was a brief delay in creating the GitHub release page after tagging, resolved on 2026-03-21.
Citations:
- 1: https://github.com/zricethezav/gitleaks/releases/latest
- 2: https://github.com/gitleaks/gitleaks/releases
- 3: Missing GitHub release for v8.30.1 gitleaks/gitleaks#2058
- 4: https://github.com/gitleaks/gitleaks
- 5: https://github.com/gitleaks/gitleaks/tree/v8.30.1
- 6: https://pkg.go.dev/github.com/zricethezav/gitleaks/v8
- 7: gitleaks/gitleaks@v8.30.0...v8.30.1
🏁 Script executed:
#!/bin/bash
# Check the actual gitleaks GitHub releases for v8.30.1
# Try accessing the release page and listing available files
curl -sSfL "https://api.github.com/repos/gitleaks/gitleaks/releases/tags/v8.30.1" 2>/dev/null | python3 -c "
import sys, json
try:
data = json.load(sys.stdin)
if 'assets' in data:
print('Available assets for v8.30.1:')
for asset in data['assets']:
print(f\" - {asset['name']}\")
if 'body' in data:
print('\nRelease notes excerpt:')
print(data['body'][:500])
except:
print('Failed to parse release data')
"Repository: petry-projects/markets
Length of output: 863
🏁 Script executed:
#!/bin/bash
# Check if gitleaks provides checksums at all and in what format
# Look at a recent release to understand the pattern
curl -sSfL "https://api.github.com/repos/gitleaks/gitleaks/releases/latest" 2>/dev/null | python3 -c "
import sys, json
try:
data = json.load(sys.stdin)
print(f\"Latest release: {data.get('tag_name', 'unknown')}\")
if 'assets' in data:
print('Assets in latest release:')
for asset in data['assets']:
print(f\" - {asset['name']}\")
except Exception as e:
print(f'Error: {e}')
"Repository: petry-projects/markets
Length of output: 528
🏁 Script executed:
#!/bin/bash
# Download and check the format of the checksums file
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_checksums.txt" 2>/dev/nullRepository: petry-projects/markets
Length of output: 1064
Add SHA256 checksum verification before installing gitleaks.
The current install step downloads and executes an external binary without validation. Gitleaks provides SHA256 checksums as a release asset; verify the downloaded binary before install.
Corrected hardening patch
- name: Install gitleaks
+ env:
+ GITLEAKS_VERSION: 8.30.1
run: |
- curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz" \
- | tar -xz gitleaks
- sudo mv gitleaks /usr/local/bin/gitleaks
+ set -euo pipefail
+ base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+ asset="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+ curl -sSfL "$base/$asset" -o "/tmp/$asset"
+ curl -sSfL "$base/gitleaks_${GITLEAKS_VERSION}_checksums.txt" -o /tmp/checksums.txt
+ grep " ${asset}$" /tmp/checksums.txt | sha256sum -c -
+ tar -xzf "/tmp/$asset" -C /tmp gitleaks
+ sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Install gitleaks | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz" \ | |
| | tar -xz gitleaks | |
| sudo mv gitleaks /usr/local/bin/gitleaks | |
| - name: Install gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| set -euo pipefail | |
| base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | |
| asset="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -sSfL "$base/$asset" -o "/tmp/$asset" | |
| curl -sSfL "$base/gitleaks_${GITLEAKS_VERSION}_checksums.txt" -o /tmp/checksums.txt | |
| grep " ${asset}$" /tmp/checksums.txt | sha256sum -c - | |
| tar -xzf "/tmp/$asset" -C /tmp gitleaks | |
| sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ci.yml around lines 142 - 147, Update the "Install
gitleaks" step to verify the downloaded tarball using its SHA256 checksum before
moving the binary to /usr/local/bin: download the corresponding gitleaks
SHA256SUM or checksum file from the same release (matching v8.30.1), compute the
checksum of the fetched tar.gz (the curl/tar sequence used in the Install
gitleaks step), compare them and fail the job if they differ, and only on a
successful match extract the gitleaks binary and run sudo mv gitleaks
/usr/local/bin/gitleaks; ensure the verification logic is implemented inline in
the Install gitleaks run block so the action aborts on mismatch.
Review — fix requested (cycle 1/3)The automated review identified the following issues. Please address each one: Findings to fix
Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
Automated review — NEEDS HUMAN REVIEWRisk: HIGH SummaryThe gitleaks binary is downloaded via curl-pipe-tar with sudo and no checksum verification — a critical supply chain risk in CI. The PR also deviates from the org push-protection standard template (which requires gitleaks/gitleaks-action, not a raw binary install), meaning the compliance audit check FindingsCritical
Major
Minor
CI statusSonarCloud Code Analysis: FAILURE (1 Security Hotspot — unverified binary download). Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with |
Uses gitleaks/gitleaks-action@v2.3.9 (pinned to SHA) instead of the direct binary install from PR #107. The compliance audit (pp_check_secret_scan_ci_job) requires `uses: gitleaks/gitleaks-action@` in ci.yml — a binary install does not satisfy the check. Key decisions: - Switched from direct binary install to gitleaks/gitleaks-action@v2.3.9 (SHA ff98106e4c7b2bc287b24eaf42907196329070c7) to satisfy the compliance audit regex - Added GITLEAKS_LICENSE env var (free key required for org repos per gitleaks-action docs; set GITLEAKS_LICENSE as an org or repo secret) - fetch-depth: 0 ensures full git history is scanned - .gitleaksignore suppresses 7 confirmed false-positive findings in commit 865de69 (documentation paths containing "api-key" substring) Closes #96 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
Auto-rebase blocked — the base branch contains Please rebase this branch manually: |
Summary
secret-scanjob toci.ymlper the push-protection standardfetch-depth: 0) on every PR and push tomain--redactto prevent leaked values from appearing in workflow logs--exit-code 1to fail CI when any secret is detectedactions/checkout→34e114876b0b11c390a56381ad16ebd13914f8d5(v4)gitleaks/gitleaks-action→ff98106e4c7b2bc287b24eaf42907196329070c7(v2.3.9)Closes #96
Generated with Claude Code
Summary by CodeRabbit