Skip to content

Commit b4bf721

Browse files
dkfellowsdkfellows
authored
Merge pull request #73 from UoMResearchIT/add-secret-scanning
Add a reusable workflow for secret scanning
2 parents d83aa43 + 36babaf commit b4bf721

File tree

3 files changed

+183
-2
lines changed

3 files changed

+183
-2
lines changed

‎.github/workflows/scan-for-secrets.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Copyright (c) 2025 The University of Manchester
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# This reusable workflow is used to scan for secrets; API keys for various
16+
# services that shouldn't be made public but instead ought to be handled
17+
# via the Github Secrets mechanisms.
18+
#
19+
# It needs no elevated permissions, and no access to real secrets.
20+
#
21+
# It uses the file secrets.baseline.json in the same directory as this
22+
# workflow to provide a baseline configuration when the user does not
23+
# specify their own.
24+
25+
name: Scan for Secrets
26+
on:
27+
workflow_call:
28+
inputs:
29+
config-file:
30+
type: string
31+
required: false
32+
default: .uomrit-actions/.github/workflows/secrets.baseline.json
33+
description: >
34+
The name of secret scanner configuration.
35+
If not supplied, a default is used.
36+
python-version:
37+
type: string
38+
required: false
39+
default: "3.12"
40+
description: >
41+
The version of Python to use to run the secret scanner.
42+
43+
jobs:
44+
check:
45+
name: Checking for Service API Keys
46+
runs-on: ubuntu-latest
47+
steps:
48+
- name: Checkout
49+
uses: actions/checkout@v4
50+
- name: Checkout default configuration file
51+
uses: actions/checkout@v4
52+
with:
53+
path: .uomrit-actions
54+
repository: UoMResearchIT/actions
55+
ref: add-secret-scanning # FIXME
56+
- name: Scan
57+
uses: secret-scanner/action@0.2.1
58+
with:
59+
# Version locked because of bugs
60+
detect_secrets_version: "1.3.0"
61+
python_version: ${{ inputs.python-version }}
62+
baseline_file: ${{ inputs.config-file }}
63+
detect_secret_additional_args: --exclude-files '.*\.uomrit-actions/.*'
64+
timeout-minutes: 10

‎.github/workflows/secrets.baseline.json‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
{
2+
"version": "1.3.0",
3+
"plugins_used": [
4+
{
5+
"name": "ArtifactoryDetector"
6+
},
7+
{
8+
"name": "AWSKeyDetector"
9+
},
10+
{
11+
"name": "AzureStorageKeyDetector"
12+
},
13+
{
14+
"name": "Base64HighEntropyString",
15+
"limit": 4.5
16+
},
17+
{
18+
"name": "BasicAuthDetector"
19+
},
20+
{
21+
"name": "CloudantDetector"
22+
},
23+
{
24+
"name": "GitHubTokenDetector"
25+
},
26+
{
27+
"name": "HexHighEntropyString",
28+
"limit": 3.0
29+
},
30+
{
31+
"name": "IbmCloudIamDetector"
32+
},
33+
{
34+
"name": "IbmCosHmacDetector"
35+
},
36+
{
37+
"name": "JwtTokenDetector"
38+
},
39+
{
40+
"name": "KeywordDetector",
41+
"keyword_exclude": ""
42+
},
43+
{
44+
"name": "MailchimpDetector"
45+
},
46+
{
47+
"name": "NpmDetector"
48+
},
49+
{
50+
"name": "PrivateKeyDetector"
51+
},
52+
{
53+
"name": "SendGridDetector"
54+
},
55+
{
56+
"name": "SlackDetector"
57+
},
58+
{
59+
"name": "SoftlayerDetector"
60+
},
61+
{
62+
"name": "SquareOAuthDetector"
63+
},
64+
{
65+
"name": "StripeDetector"
66+
},
67+
{
68+
"name": "TwilioKeyDetector"
69+
}
70+
],
71+
"filters_used": [
72+
{
73+
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
74+
},
75+
{
76+
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
77+
"min_level": 2
78+
},
79+
{
80+
"path": "detect_secrets.filters.gibberish.should_exclude_secret",
81+
"limit": 3.7
82+
},
83+
{
84+
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
85+
},
86+
{
87+
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
88+
},
89+
{
90+
"path": "detect_secrets.filters.heuristic.is_lock_file"
91+
},
92+
{
93+
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
94+
},
95+
{
96+
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
97+
},
98+
{
99+
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
100+
},
101+
{
102+
"path": "detect_secrets.filters.heuristic.is_sequential_string"
103+
},
104+
{
105+
"path": "detect_secrets.filters.heuristic.is_swagger_file"
106+
},
107+
{
108+
"path": "detect_secrets.filters.heuristic.is_templated_secret"
109+
}
110+
],
111+
"results": {},
112+
"generated_at": "2025-07-30T13:06:35Z"
113+
}

‎README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@ These are intended for use in many types of project, wherever relevant.
1717

1818
* [`instantiate-file`](instantiate-file) creates a file with a value provided by your workflow.
1919

20-
* ['add_prs_to_project (reusable workflow)](.github/workflows/add_prs_to_project.yml) is a reusable workflow that you can use in your repository to add any PRs assigned to a user to a Project and set the Status in the project to a value of your choosing.
21-
2220
## Linux runners only
2321

2422
* [`apt-get-install`](apt-get-install) installs packages into Ubuntu runners, allowing for subtleties of installation that have been found to come up with some packages "in the wild".
@@ -29,6 +27,12 @@ These are intended for use in many types of project, wherever relevant.
2927

3028
* [`todo`](todo) finds `FIXME` and `TODO` comments in code.
3129

30+
## Reusable Workflows
31+
32+
* [`add_prs_to_project` (reusable workflow)](.github/workflows/add_prs_to_project.yml) is a reusable workflow that you can use in your repository to add any PRs assigned to a user to a Project and set the Status in the project to a value of your choosing.
33+
34+
* [`scan-for-secrets` (reusable workflow)](.github/workflows/scan-for-secrets.yml) is a reusable workflow that you can use in your repository to scan for API keys (e.g., for AWS) that your code accidentally exposes.
35+
3236
# Language-Specific Tools
3337

3438
These often have platform requirements for their runners. You can always have several jobs in a workflow to allow the use of Linux runners in an otherwise Windows-specific build scheme.

0 commit comments

Comments
 (0)