ci: Upgrade secret scanning workflow INF-162

[dongchenxie]

Summary

• upgrade the reusable secret scanning workflow to run Gitleaks with TN shared rules and TruffleHog verified detection
• add pr, push, and non-blocking history scan modes with fetch depth, fail threshold, config ref/path, and scanner version inputs
• sanitize summaries and Slack notifications so raw secret values are not printed
• upload a complete sanitized JSON inventory plus Markdown summary for remediation work without uploading raw scanner reports
• constrain PR/push scans to their incremental commit range and skip unrelated Git refs
• fail closed on malformed scanner output and avoid persisting checkout credentials into the scanner-mounted workspace
• use Node 24-based, immutable checkout and artifact action references
• fix the caller example to reference treasurenetprotocol/reusable-workflows and document minimal TN repository usage
• make the shared Gitleaks config compatible with Gitleaks v8.27.2 RE2 repeat limits discovered during runtime validation

Notes

• INF-161 is merged, so this branch is based on current main and consumes security/gitleaks/tn-gitleaks.toml.
• History mode scans all available Git history and produces a non-blocking, 30-day remediation artifact.
• PR and push modes fail when findings meet fail_threshold.
• New-branch pushes use the default-branch merge-base; repositories with no merge-base scan only HEAD instead of unrelated history.
• Manual dispatch always runs non-blocking history mode because manual events do not provide a native PR/push range.
• Only summary.md and sanitized-findings.json are uploaded. Raw Gitleaks and TruffleHog reports remain local to the runner and are never included in the artifact.
• Confirmed secrets still require rotation, revocation, migration, or abandonment.

Validation

• Parsed workflow YAML and compiled all three embedded Python blocks.
• Ran actionlint v1.7.12 against both changed workflow files with no findings.
• Parsed security/gitleaks/tn-gitleaks.toml with Python tomllib.
• Ran Gitleaks v8.27.2 against generated positive fixtures: 25 findings, all report values redacted.
• Ran Gitleaks v8.27.2 against committed negative fixtures: 0 findings.
• Validated Git range behavior in a temporary repository:
  • add-secret commit range: 25 findings
  • cleanup-only commit range: 0 findings
  • add-then-remove range: 25 findings
  • full history after removal: 25 findings
• Generated the sanitized inventory from the positive report: all 25 findings retained, only approved metadata fields present, no fixture secret value present.
• Confirmed malformed non-empty TruffleHog JSONL fails closed with exit 2 while blank lines remain ignored.
• Completed full reusable workflow_call validation from an isolated synthetic branch in treasurenetprotocol/technical-demo:
  • safe incremental run: passed with 0 findings
  • synthetic blocking run: failed as expected with 25 findings, all limited to the test commit/path
  • cleanup-only run: passed
  • non-blocking history run: passed while preserving all 25 findings in the sanitized artifact
  • final review-fix run: passed with the hardened checkout settings
• Addressed all three substantive CodeRabbit review findings in 18e0d3a.
• Ran git diff --check.
• PR CI lint-and-validate and CodeRabbit checks pass at 18e0d3a.

Remaining Gate

• Repository policy still requires a human approval before merge.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request introduces a reusable workflow that runs Gitleaks and TruffleHog with configurable scan modes, thresholds, versions, and shared configuration. It updates triggers, documentation, artifact and Slack handling, and tightens three Gitleaks detection patterns.

Changes

TN secret scanning

Layer / File(s)	Summary
Workflow contract and caller wiring .github/workflows/reusable-secrets-scanning.yml, .github/workflows/secrets-scanning.yml, README.md	The reusable workflow and caller now support scan modes, fetch depth, fail thresholds, shared configuration references, pinned tool versions, expanded triggers, and documented invocation inputs.
Validation, checkout, and scan ranges .github/workflows/reusable-secrets-scanning.yml	Inputs are validated, the caller and shared configuration repositories are checked out, and scan ranges are derived for pull request, push, and history modes.
Gitleaks and TruffleHog execution .github/workflows/reusable-secrets-scanning.yml, security/gitleaks/tn-gitleaks.toml	Pinned Docker-based Gitleaks and TruffleHog scans produce JSON and JSONL reports, while three Gitleaks regex distance limits are reduced.
Finding processing and enforcement .github/workflows/reusable-secrets-scanning.yml	Reports are sanitized and summarized, threshold outputs control artifact upload and Slack notification, and blocking findings fail the workflow.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CallerWorkflow
  participant ReusableSecretScan
  participant Gitleaks
  participant TruffleHog
  participant FindingsProcessor
  participant Slack
  CallerWorkflow->>ReusableSecretScan: invoke with scan mode and scan settings
  ReusableSecretScan->>Gitleaks: run configured repository scan
  ReusableSecretScan->>TruffleHog: run repository scan
  Gitleaks-->>FindingsProcessor: JSON findings
  TruffleHog-->>FindingsProcessor: JSONL findings
  FindingsProcessor->>Slack: send sanitized blocking-finding summary
  FindingsProcessor-->>ReusableSecretScan: should_fail output
  ReusableSecretScan-->>CallerWorkflow: success or failure status

Loading

Suggested reviewers: chriszhao1988, shahar-w

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: an upgrade to the secret scanning workflow.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/secret-scanning-workflow-INF-162

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/reusable-secrets-scanning.yml:
- Around line 260-270: Update the TruffleHog report parsing loop around
trufflehog_report so any non-empty line that raises json.JSONDecodeError causes
the scan/report processing to fail closed instead of being skipped. Preserve
ignoring blank lines, and propagate or explicitly report the malformed-record
failure through the existing scan error path.
- Around line 94-98: Set persist-credentials to false in both the caller
repository checkout and the configuration checkout steps in
reusable-secrets-scanning.yml (caller checkout lines 94-98; configuration
checkout lines 100-106) before the workspace is mounted into scanner containers.

In @.github/workflows/secrets-scanning.yml:
- Around line 9-19: Restrict the workflow_dispatch scan_mode input in
.github/workflows/secrets-scanning.yml lines 9-19 to history, and update the
mode mapping at lines 25-25 so manual runs always use history unless explicit
range inputs are added. Remove unsupported manual pr and push options from
README.md lines 40-50 and document manual dispatch as history at line 56.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f9856eae-1c3a-400e-a379-71277fe2dcc0

📥 Commits

Reviewing files that changed from the base of the PR and between e6068d9 and f06c324.

📒 Files selected for processing (4)

• .github/workflows/reusable-secrets-scanning.yml
• .github/workflows/secrets-scanning.yml
• README.md
• security/gitleaks/tn-gitleaks.toml