ci: add trusted PyPI publishing (#4) #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Secret-scan backstop. Historical exceptions are exact reviewed fingerprints. | |
| name: secret-scan | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install checksum-verified Gitleaks | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| curl --fail --show-error --silent --location -o /tmp/gitleaks.tar.gz \ | |
| https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | |
| echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb /tmp/gitleaks.tar.gz" | sha256sum --check | |
| tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks | |
| sudo install /tmp/gitleaks /usr/local/bin/gitleaks | |
| - name: Scan complete reachable history | |
| run: gitleaks git . --log-opts=HEAD --config .gitleaks.toml --redact --verbose | |
| - name: Prove broad placeholder labels cannot suppress a secret | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| tmp="$(mktemp -d)" | |
| git -C "$tmp" init --quiet | |
| git -C "$tmp" config user.name "Secret Scan Control" | |
| git -C "$tmp" config user.email "security-control@example.invalid" | |
| half='0123456789abcdef0123456789abcdef' | |
| printf 'example_private_key = 0x%s%s\n' "$half" "$half" > "$tmp/leak.txt" | |
| git -C "$tmp" add leak.txt | |
| git -C "$tmp" commit --quiet -m "synthetic leak" | |
| if gitleaks git "$tmp" --log-opts=HEAD \ | |
| --config "$GITHUB_WORKSPACE/.gitleaks.toml" --redact; then | |
| echo "::error::Gitleaks accepted the committed negative-control secret" | |
| exit 1 | |
| fi | |
| echo "Gitleaks rejected the committed negative-control secret as expected" | |
| infra-strings: | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Reject operational infrastructure strings | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| pattern='172\.(30|31)\.[0-9]+\.[0-9]+|/Users/[a-z0-9._-]+/|aipgcoregen|aipg-transient|BEGIN ((RSA|EC|OPENSSH) )?PRIVATE KEY' | |
| for sample in \ | |
| '172.''30''.1.2' \ | |
| '/Us''ers/operator/' \ | |
| 'aipgcore''gen' \ | |
| 'aipg-trans''ient' \ | |
| 'BEGIN ''PRIVATE KEY' \ | |
| 'BEGIN OPEN''SSH PRIVATE KEY'; do | |
| if ! printf '%s\n' "$sample" | grep -Eq "$pattern"; then | |
| echo "::error::infra-string scanner failed its negative control" | |
| exit 1 | |
| fi | |
| done | |
| result=0 | |
| matches="$(git grep -nIE "$pattern" -- . ':(exclude).gitleaks.toml' ':(exclude)**/secret-scan.yml')" || result=$? | |
| if [ "$result" -gt 1 ]; then | |
| echo "::error::infra-string scanner failed to execute" | |
| exit "$result" | |
| fi | |
| if [ "$result" -eq 0 ]; then | |
| printf '%s\n' "$matches" | |
| echo "::error::operational infrastructure or secret material found above" | |
| exit 1 | |
| fi |