Refresh Vendored Rules #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Refresh Vendored Rules | |
| # Weekly cron + on-demand. Re-vendors the gitleaks default config (kit/scope) | |
| # and the Presidio PII pack (kit/redact) from latest tagged upstream releases | |
| # and opens a PR per corpus when the vendored files change. | |
| # | |
| # Tag inputs come from the upstream GitHub release-tag API via the gh CLI; | |
| # they are author-controlled by the maintainers of those repos but are not | |
| # arbitrary user input. We pass them through env: anyway so the workflow | |
| # stays consistent with GitHub's command-injection guidance. | |
| on: | |
| schedule: | |
| - cron: "0 6 * * 1" # Mondays 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Refresh gitleaks rules | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: make refresh-secret-rules | |
| - name: Detect changes | |
| id: diff | |
| run: | | |
| if git diff --quiet -- go/core/scope/rules/; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| TAG=$(cat /tmp/gitleaks-tag) | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run scope tests against new rules | |
| if: steps.diff.outputs.changed == 'true' | |
| run: | | |
| # Smoke-test that the regenerated TOML still parses. | |
| go test ./go/core/scope/... -count=1 -short || true | |
| - name: Open PR | |
| if: steps.diff.outputs.changed == 'true' | |
| uses: peter-evans/create-pull-request@v6 | |
| env: | |
| TAG: ${{ steps.diff.outputs.tag }} | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| branch: chore/refresh-gitleaks-rules | |
| delete-branch: true | |
| commit-message: "chore(scope): refresh gitleaks rules to ${{ env.TAG }}" | |
| title: "chore(scope): refresh gitleaks rules to ${{ env.TAG }}" | |
| body: | | |
| Auto-generated by `.github/workflows/refresh-rules.yml`. | |
| Re-vendored `go/core/scope/rules/gitleaks-{paths,content}.toml` | |
| from gitleaks upstream at the tag listed in the title. | |
| Reviewer checklist: | |
| - [ ] Diff looks reasonable (new rules, no surprise removals) | |
| - [ ] No new path patterns that would deny too aggressively | |
| (if so, add an override in scope's allowlist) | |
| - [ ] Schema unchanged (no breaking restructure of upstream TOML) | |
| labels: | | |
| scope | |
| vendoring | |
| chore | |
| presidio: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Refresh Presidio PII rules | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: make refresh-pii-rules | |
| - name: Detect changes | |
| id: diff | |
| run: | | |
| if git diff --quiet -- go/core/redact/rules/; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| TAG=$(cat /tmp/presidio-tag) | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run redact tests against new rules | |
| if: steps.diff.outputs.changed == 'true' | |
| run: | | |
| go test ./go/core/redact/... -count=1 -short || true | |
| - name: Open PR | |
| if: steps.diff.outputs.changed == 'true' | |
| uses: peter-evans/create-pull-request@v6 | |
| env: | |
| TAG: ${{ steps.diff.outputs.tag }} | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| branch: chore/refresh-presidio-rules | |
| delete-branch: true | |
| commit-message: "chore(redact): refresh PII rules to ${{ env.TAG }}" | |
| title: "chore(redact): refresh PII rules to ${{ env.TAG }}" | |
| body: | | |
| Auto-generated by `.github/workflows/refresh-rules.yml`. | |
| Re-vendored `go/core/redact/rules/presidio-pii.toml` from | |
| microsoft/presidio at the tag listed in the title. | |
| Reviewer checklist: | |
| - [ ] Diff looks reasonable (new patterns, no over-broad rules) | |
| - [ ] Any over-broad pattern → add to global allowlist or drop | |
| - [ ] Schema unchanged ([[rule]] entries, no upstream API drift) | |
| - [ ] Run `go test ./go/core/redact/...` locally to confirm | |
| labels: | | |
| redact | |
| vendoring | |
| chore |