Skip to content

Commit b85290c

Browse files
chtruong814chtruong814
committed
ci: Add secrets detector
Signed-off-by: Charlie Truong <chtruong@nvidia.com>
1 parent 4a9db77 commit b85290c

File tree

2 files changed

+216
-0
lines changed

2 files changed

+216
-0
lines changed

‎.github/workflows/config/.secrets.baseline‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
{
2+
"version": "1.5.0",
3+
"plugins_used": [
4+
{
5+
"name": "ArtifactoryDetector"
6+
},
7+
{
8+
"name": "AWSKeyDetector"
9+
},
10+
{
11+
"name": "AzureStorageKeyDetector"
12+
},
13+
{
14+
"name": "Base64HighEntropyString",
15+
"limit": 4.5
16+
},
17+
{
18+
"name": "BasicAuthDetector"
19+
},
20+
{
21+
"name": "CloudantDetector"
22+
},
23+
{
24+
"name": "DiscordBotTokenDetector"
25+
},
26+
{
27+
"name": "GitHubTokenDetector"
28+
},
29+
{
30+
"name": "GitLabTokenDetector"
31+
},
32+
{
33+
"name": "HexHighEntropyString",
34+
"limit": 3.0
35+
},
36+
{
37+
"name": "IbmCloudIamDetector"
38+
},
39+
{
40+
"name": "IbmCosHmacDetector"
41+
},
42+
{
43+
"name": "IPPublicDetector"
44+
},
45+
{
46+
"name": "JwtTokenDetector"
47+
},
48+
{
49+
"name": "KeywordDetector",
50+
"keyword_exclude": ""
51+
},
52+
{
53+
"name": "MailchimpDetector"
54+
},
55+
{
56+
"name": "NpmDetector"
57+
},
58+
{
59+
"name": "OpenAIDetector"
60+
},
61+
{
62+
"name": "PrivateKeyDetector"
63+
},
64+
{
65+
"name": "PypiTokenDetector"
66+
},
67+
{
68+
"name": "SendGridDetector"
69+
},
70+
{
71+
"name": "SlackDetector"
72+
},
73+
{
74+
"name": "SoftlayerDetector"
75+
},
76+
{
77+
"name": "SquareOAuthDetector"
78+
},
79+
{
80+
"name": "StripeDetector"
81+
},
82+
{
83+
"name": "TelegramBotTokenDetector"
84+
},
85+
{
86+
"name": "TwilioKeyDetector"
87+
}
88+
],
89+
"filters_used": [
90+
{
91+
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
92+
},
93+
{
94+
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
95+
"min_level": 2
96+
},
97+
{
98+
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
99+
},
100+
{
101+
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
102+
},
103+
{
104+
"path": "detect_secrets.filters.heuristic.is_lock_file"
105+
},
106+
{
107+
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
108+
},
109+
{
110+
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
111+
},
112+
{
113+
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
114+
},
115+
{
116+
"path": "detect_secrets.filters.heuristic.is_sequential_string"
117+
},
118+
{
119+
"path": "detect_secrets.filters.heuristic.is_swagger_file"
120+
},
121+
{
122+
"path": "detect_secrets.filters.heuristic.is_templated_secret"
123+
},
124+
{
125+
"path": "detect_secrets.filters.regex.should_exclude_file",
126+
"pattern": [
127+
"pyproject\\.toml|\\.github/workflows/config/\\.secrets\\.baseline"
128+
]
129+
}
130+
],
131+
"results": {
132+
"docs/guides/execution.md": [
133+
{
134+
"type": "Secret Keyword",
135+
"filename": "docs/guides/execution.md",
136+
"hashed_secret": "532abb38bbbf7f304a3db907a31f5ecf2cd9e90a",
137+
"is_verified": false,
138+
"line_number": 267
139+
}
140+
],
141+
"docs/guides/ray.md": [
142+
{
143+
"type": "Secret Keyword",
144+
"filename": "docs/guides/ray.md",
145+
"hashed_secret": "fd385d38140af325c5a7d4ba662a2d0747acce43",
146+
"is_verified": false,
147+
"line_number": 222
148+
}
149+
],
150+
"test/core/execution/test_dgxcloud.py": [
151+
{
152+
"type": "Secret Keyword",
153+
"filename": "test/core/execution/test_dgxcloud.py",
154+
"hashed_secret": "eb3d6b8a9e2a4087e2690c93f6f8a98ec33777fe",
155+
"is_verified": false,
156+
"line_number": 34
157+
}
158+
],
159+
"test/core/execution/test_lepton.py": [
160+
{
161+
"type": "Secret Keyword",
162+
"filename": "test/core/execution/test_lepton.py",
163+
"hashed_secret": "cf38af6a2b49c4106a6828cba9c1ca1fba1c3be4",
164+
"is_verified": false,
165+
"line_number": 108
166+
},
167+
{
168+
"type": "Secret Keyword",
169+
"filename": "test/core/execution/test_lepton.py",
170+
"hashed_secret": "fe1bae27cb7c1fb823f496f286e78f1d2ae87734",
171+
"is_verified": false,
172+
"line_number": 392
173+
}
174+
],
175+
"test/run/torchx_backend/schedulers/test_dgxcloud.py": [
176+
{
177+
"type": "Secret Keyword",
178+
"filename": "test/run/torchx_backend/schedulers/test_dgxcloud.py",
179+
"hashed_secret": "72cb70dbbafe97e5ea13ad88acd65d08389439b0",
180+
"is_verified": false,
181+
"line_number": 41
182+
}
183+
],
184+
"test/run/torchx_backend/test_packaging.py": [
185+
{
186+
"type": "Base64 High Entropy String",
187+
"filename": "test/run/torchx_backend/test_packaging.py",
188+
"hashed_secret": "62d9498a9bb501cca21909ca0d4ca2851ce2eb66",
189+
"is_verified": false,
190+
"line_number": 72
191+
}
192+
]
193+
},
194+
"generated_at": "2026-01-31T00:24:37Z"
195+
}

‎.github/workflows/detect-secrets.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright (c) 2026 NVIDIA CORPORATION.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
name: Secrets detector
15+
16+
on:
17+
pull_request:
18+
19+
jobs:
20+
secrets-detector:
21+
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@v0.70.0

0 commit comments

Comments
 (0)