ci: add secret-scan (gitleaks) job for push-protection compliance by don-petry · Pull Request #115 · petry-projects/markets

don-petry · 2026-04-18T18:45:34Z

Summary

Adds the required secret-scan job to .github/workflows/ci.yml per Layer 3 of the push-protection standard. This satisfies the secret_scan_ci_job_present compliance check (error severity).
Also applied security_and_analysis settings via the GitHub API: secret scanning, push protection, and Dependabot security updates are now enabled at the repo level. This addresses the root cause of the security_and_analysis_unavailable compliance warning.

Job properties:

Full-history checkout (fetch-depth: 0) — scans all commits, not just the PR diff
--redact — leaked values are never written to workflow logs
--exit-code 1 — build fails on any finding
Both actions pinned to commit SHAs per Action Pinning Policy

Supersedes: #106 (same secret-scan job, on a stale branch — that PR can be closed)

Remaining human-action items (cannot be done in code)

The following settings could not be enabled via API (likely plan limitations):

secret_scanning_ai_detection — not returned by the API (may require a paid plan)
secret_scanning_non_provider_patterns — returned as disabled after our PATCH

An org admin should verify in GitHub Settings → Code security whether these features are available on the current plan and enable them if possible.

Test plan

CI passes (secret-scan job runs cleanly — no secrets in history)
Weekly compliance audit no longer reports security_and_analysis_unavailable
Verify GitHub Settings → Code security shows secret scanning + push protection enabled

Closes #95

Generated with Claude Code

Adds the required secret-scan job to ci.yml per Layer 3 of the push-protection standard. Satisfies the secret_scan_ci_job_present compliance check (error severity). Key properties: - Full history checkout (fetch-depth: 0) — scans all commits, not just diff - --redact — leaked values are never written to workflow logs - --exit-code 1 — build fails on any finding - Both actions pinned to commit SHAs per Action Pinning Policy Also applied security_and_analysis settings via API (secret scanning, push protection, and Dependabot security updates now enabled at repo level), addressing the security_and_analysis_unavailable warning. Closes #95 Supersedes #106 Co-authored-by: don-petry <don-petry@users.noreply.github.com>

coderabbitai · 2026-04-18T18:45:41Z

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 56 minutes and 28 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 56 minutes and 28 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2370376d-1b53-4652-be36-c001aa20d41c

📥 Commits

Reviewing files that changed from the base of the PR and between f9d9937 and 2670b67.

📒 Files selected for processing (1)

.github/workflows/ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/issue-95-20260418-1841

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

don-petry · 2026-04-18T18:46:39Z

@don-petry — this PR addresses issue #95 by:

Adding the secret-scan (gitleaks) job to ci.yml per Layer 3 of the push-protection standard. Satisfies the secret_scan_ci_job_present compliance check (error severity).
Enabling repo-level security settings via API: secret scanning, push protection, and Dependabot security updates are now enabled, which should resolve the security_and_analysis_unavailable warning on the next weekly audit.

This supersedes PR #106 (same fix, on a stale branch).

Remaining items requiring human admin action:

secret_scanning_ai_detection and secret_scanning_non_provider_patterns could not be enabled (likely plan limitations — the API returned them as disabled after the PATCH). Please verify in GitHub Settings → Code security and enable if available on your plan.

sonarqubecloud · 2026-04-18T18:50:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a dedicated CI job to run gitleaks secret scanning to satisfy push-protection compliance requirements and fail CI on detected leaks.

Changes:

Introduces a new secret-scan job in CI that checks out full git history and runs gitleaks detect.
Pins the actions/checkout and gitleaks/gitleaks-action actions to commit SHAs.
Configures gitleaks to redact findings and exit non-zero on detections.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-18T18:51:29Z

+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout (full history)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        # Pinned to commit SHA (dereferenced from annotated tag v2).
+        # Refresh with: gh api repos/gitleaks/gitleaks-action/git/refs/tags/v2 --jq '.object.sha'
+        # then dereference: gh api repos/gitleaks/gitleaks-action/git/tags/<sha> --jq '.object.sha'
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        with:
+          args: detect --source . --redact --verbose --exit-code 1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


security-events: write is granted but the workflow doesn’t upload a SARIF/code-scanning artifact (and the gitleaks invocation doesn’t emit SARIF). Either (a) drop security-events: write to follow least-privilege, or (b) have gitleaks produce a SARIF report and add an explicit upload step so the permission is actually used.

Copilot · 2026-04-18T18:51:30Z

+      - name: Checkout (full history)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0


Full-history checkout (fetch-depth: 0) can noticeably increase CI time and bandwidth as the repo grows. If compliance allows, consider running full-history scans on a schedule (or default-branch only) and limiting PR/push scans to the commit range being introduced; otherwise, note in the workflow comment that this is intentionally full-history for compliance to prevent future “optimization” regressions.

Suggested change

- name: Checkout (full history)

uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

with:

fetch-depth: 0

- name: Checkout

uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

Copilot · 2026-04-18T18:51:30Z

+  # ── Secret scanning (gitleaks) ────────────────────────────────────────────
+  secret-scan:


The PR description claims repo-level security_and_analysis settings were enabled via the GitHub API, but those changes are not reviewable/auditable in this PR diff. Consider moving that note to the PR’s comments/runbook (or link to an audit log/change record) and keep the PR description focused on the workflow change, so reviewers can validate everything claimed from the PR contents.

github-actions · 2026-04-21T04:14:10Z

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

Copilot AI review requested due to automatic review settings April 18, 2026 18:45

don-petry mentioned this pull request Apr 18, 2026

Compliance: security_and_analysis_unavailable #95

Open

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Copilot started reviewing on behalf of don-petry April 18, 2026 18:55 View session

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add secret-scan (gitleaks) job for push-protection compliance#115

ci: add secret-scan (gitleaks) job for push-protection compliance#115
don-petry wants to merge 1 commit intomainfrom
claude/issue-95-20260418-1841

don-petry commented Apr 18, 2026

Uh oh!

coderabbitai Bot commented Apr 18, 2026

Rate limit exceeded

Uh oh!

don-petry commented Apr 18, 2026

Uh oh!

sonarqubecloud Bot commented Apr 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 18, 2026

Uh oh!

Copilot AI Apr 18, 2026

Uh oh!

Copilot AI Apr 18, 2026

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		# ── Secret scanning (gitleaks) ────────────────────────────────────────────
		secret-scan:

Conversation

don-petry commented Apr 18, 2026

Summary

Remaining human-action items (cannot be done in code)

Test plan

Uh oh!

coderabbitai Bot commented Apr 18, 2026

Rate limit exceeded

Uh oh!

don-petry commented Apr 18, 2026

Uh oh!

sonarqubecloud Bot commented Apr 18, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants