[codex] Add secret scanning guardrail#66
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds repository secret-scanning: a GitHub Actions workflow that runs TruffleHog on PRs, master pushes, and manual runs; updates .gitignore to track workflow files; and adds docs describing the workflow scope and incident response steps. ChangesSecret Scanning Implementation
Sequence DiagramsequenceDiagram
participant GH as GitHub (event)
participant Runner as Actions Runner
participant Truffle as TruffleHog
participant Maint as Maintainer
GH->>Runner: push / pull_request / manual dispatch
Runner->>Runner: checkout repo (fetch-depth: 0)
Runner->>Truffle: run scan (base/head per event, --results=verified)
Truffle-->>Runner: scan results (verified)
Runner->>GH: write workflow logs/artifacts
alt verified findings
GH->>Maint: alert / workflow output references (no raw secret)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/secret-scan.yml (1)
46-47: 💤 Low valueConsider using
github.shainstead ofgithub.ref_namefor consistency.For new branch tips, the
headparameter usesgithub.ref_name(the branch name) while other steps use SHAs. TruffleHog likely accepts both, but usinggithub.shawould be more consistent with the other scan steps and explicitly references the commit SHA.♻️ Proposed change for consistency
- name: Scan new branch tip if: github.event_name == 'push' && github.event.before == '0000000000000000000000000000000000000000' uses: trufflesecurity/trufflehog@v3.95.3 with: path: ./ base: "" - head: ${{ github.ref_name }} + head: ${{ github.sha }} extra_args: --results=verified🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/secret-scan.yml around lines 46 - 47, Replace the head value that currently uses github.ref_name with github.sha to make the TruffleHog scan use the commit SHA consistently; update the line containing head: ${{ github.ref_name }} to head: ${{ github.sha }} so it matches other scan steps and explicitly references the commit SHA.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/secret-scan.yml:
- Around line 46-47: Replace the head value that currently uses github.ref_name
with github.sha to make the TruffleHog scan use the commit SHA consistently;
update the line containing head: ${{ github.ref_name }} to head: ${{ github.sha
}} so it matches other scan steps and explicitly references the commit SHA.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: df05c204-6fce-4850-b462-dae65ebfe5fb
📒 Files selected for processing (3)
.github/workflows/secret-scan.yml.gitignoredocs/security/secret-scanning.md
|
Thanks for the review pass. I addressed the CodeRabbit consistency nit in bb22ac8 and both GitGuardian and CodeRabbit are green again. This remains a CI/docs-only Phase 9 guardrail slice. I did not include a video because there is no user-facing flow and the PR intentionally avoids live AWS/IAM, bucket policy, candidate data, or secret values. If you need a different proof format for this guardrail slice, I can add one. |
1 participant
/claim #55
Summary
master.github/workflows/*.ymlso the workflow can be tracked without opening up all.github/filesScope
This is a non-overlapping Phase 9 guardrail slice. It does not touch AWS/IAM, live buckets, bucket policies, candidate data, existing credential values, or the Civil ID/S3/SQS/MediaConvert/SES/Xero slices already covered by other PRs.
Validation
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/secret-scan.yml"); puts "yaml ok"'git diff --cached --checkI did not include a live-data demo because this PR is CI/docs-only and intentionally avoids authenticated production flows, AWS resources, candidate records, or secret values.
Summary by CodeRabbit
Documentation
Chores