Sign up
View stargazersSign up

Security: fail CI when a commit adds a secret#15

merged1
main
security/secret-scanning
opened22d agobySScreen
2 files changed
View on GitHubTwo-way sync enabledPR last imported 21d ago

Bottom of the stack: #15 → #16 → #17

Merge order: #15, then #16, then #17. delete_branch_on_merge is off, so click Delete branch after each merge; that makes GitHub retarget the next PR to main.

Summary

Adds a CI check that fails when a pull request or a push to main adds a secret. A Google API key reached .env.example in 04f8ab5 and was only removed by hand in the next commit.

diff
1+.github/workflows/secret-scan.yml # gitleaks 8.30.1 (sha256-checked) on the new commits only
2+.gitleaks.toml # built-in rules + comfy-api-key, .agents/ allowlisted
text
1on pull_request | push to main
2 checkout (full history)
3 gitleaks git --log-opts "<base>..<head>" --redact
4 fail on any finding

.agents/ is allowlisted because the vendored skill docs use sample tokens in their examples (11 findings in 2002dfe, all docs).

Evidence

  • Before: nothing checks commits. 04f8ab5 added a live-format Google key to .env.example. After: this config reports gcp-api-key .env.example@04f8ab5 on that commit, and the scan exits 1.
  • Full history of main with this config: one finding, the same revoked key.
  • This PR's own commit range: no leaks found, exit 0.
  • The key itself was revoked. The Gemini API rejects it with API_KEY_INVALID.

Merge Danger

Door: two-way

Blast Radius: CI

New PRs fail if they add a key-shaped string. A false positive can be allowlisted in .gitleaks.toml.

Summary by CodeRabbit

  • Chores
    • Added automated secret scanning for pull requests and pushes to the main branch, helping catch exposed credentials before changes are merged.
    • Scanning now recognizes an additional credential-like token pattern and excludes specified agent-related paths.

Checks

1 pending · 1 successful
Checks in progress

In progress1

d1556fe

Added 1 commit

  • Fail CI when a commit adds a secretd1556fe
CcoderabbitaiBot22d ago
Synced from GitHub

Review in Change Stack →

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: d4a0225e-9bbc-4d20-84b0-383995e5d9b2
📥 Commits

Reviewing files that changed from the base of the PR and between 077dcb2b978847931a809e6f3b1170eb6d69463d and d1556fe02343eca5a69f711b82718d1b20a4b44d.

📒 Files selected for processing: 2
  • .github/workflows/secret-scan.yml
  • .gitleaks.toml
ascii
1+--------------------------------------------+
2| `undefined` is not a business requirement. |
3+--------------------------------------------+
4 \
5 \ (\__/)
6 (•ㅅ•)
7 / 　 づ
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.