Add secrets detection

.github/workflows/secrets-detection.yaml

@@ -0,0 +1,70 @@
+name: Secret Detection Workflow
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        branches:
+            - main
+
+jobs:
+    secret-detection:
+        runs-on: ubuntu-latest
+        steps:
+            -
+                name: Checkout code
+                uses: actions/checkout@v4
+            -
+                name: Install necessary packages
+                run: |
+                    pip install git+https://github.com/NASA-AMMOS/slim-detect-secrets.git@exp
+                    pip install jq
+
+            -
+                name: Create an initial .secrets.baseline if .secrets.baseline does not exist
+                run: |
+                    if [ ! -f .secrets.baseline ]; then
+                        # This generated baseline file will only be temporarily available on the GitHub side and will not appear in the user's local files.
+                        # Scanning an empty folder to generate an initial .secrets.baseline without secrets in the results.
+                        echo "⚠️ No existing .secrets.baseline file detected. Creating a new blank baseline file."
+                        mkdir empty-dir
+                        detect-secrets scan empty-dir > .secrets.baseline
+                        echo "✅ Blank .secrets.baseline file created successfully."
+                        rm -r empty-dir
+                    else
+                        echo "✅ Existing .secrets.baseline file detected. No new baseline file will be created."
+                    fi
+
+            -
+                name: Scan repository for secrets
+                run: |
+                    # scripts to scan repository for new secrets
+
+                    # backup the list of known secrets
+                    cp .secrets.baseline .secrets.new
+
+                    # find the secrets in the repository
+                    detect-secrets scan --disable-plugin AbsolutePathDetectorExperimental --baseline .secrets.new \
+                        --exclude-files '\.secrets..*' \
+                        --exclude-files '\.pre-commit-config\.yaml' \
+                        --exclude-files '\.git.*' \
+                        --exclude-files 'target'
+
+                    # if there is any difference between the known and newly detected secrets, break the build
+                    # Function to compare secrets without listing them
+                    compare_secrets() { diff <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "$1" | sort) <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "$2" | sort) >/dev/null; }
+
+                    # Check if there's any difference between the known and newly detected secrets
+                    if ! compare_secrets .secrets.baseline .secrets.new; then
+                        echo "⚠️ Attention Required! ⚠️" >&2
+                        echo "New secrets have been detected in your recent commit. Due to security concerns, we cannot display detailed information here and we cannot proceed until this issue is resolved." >&2
+                        echo "" >&2
+                        echo "Please follow the steps below on your local machine to reveal and handle the secrets:" >&2
+                        echo "" >&2
+                        echo "1️⃣ Run the 'detect-secrets' tool on your local machine. This tool will identify and clean up the secrets. You can find detailed instructions at this link: https://nasa-ammos.github.io/slim/continuous-testing/starter-kits/#detect-secrets" >&2
+                        echo "" >&2
+                        echo "2️⃣ After cleaning up the secrets, commit your changes and re-push your update to the repository." >&2
+                        echo "" >&2
+                        echo "Your efforts to maintain the security of our codebase are greatly appreciated!" >&2
+                        exit 1
+                    fi

.pre-commit-config.yaml

@@ -0,0 +1,35 @@
+# Pre-Commit
+# ==========
+#
+# Pre-Commit (https://pre-commit.com/) is a framework for handling the hooks
+# for git to easily standardizez on linters, code-cleaners, security
+# scanners, etc.
+#
+# Currently for Java repositories, we support the following hooks:
+#
+# - Detect Secrets (https://nasa-ammos.github.io/slim/docs/guides/software-lifecycle/security/secrets-detection/)
+#
+# Future hooks could include: trailing whitespace alerts, executable shebangs,
+# debug statements left in code, Google code style adherence, etc.
+
+
+---
+
+repos:
+    -
+        repo: https://github.com/NASA-AMMOS/slim-detect-secrets
+        # using commit id for now, will change to tag when official version is released
+        rev: 91e097ad4559ae6ab785c883dc5ed989202c7fbe
+        hooks:
+          - id: detect-secrets
+            args:
+              - '--baseline'
+              - '.secrets.baseline'
+              - --exclude-files '\.secrets..*'
+              - --exclude-files '\.git.*'
+              - --exclude-files '\.pre-commit-config\.yaml'
+              - --exclude-files 'target'
+
+...
+
+# -*- mode: YAML; tab-width: 4 -*-

.secrets.baseline

@@ -0,0 +1,241 @@
+{
+  "version": "1.4.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AWSSensitiveInfoDetectorExperimental"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "EmailAddressDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        "\\.secrets..*",
+        "\\.git.*",
+        "\\.pre-commit-config\\.yaml",
+        "target"
+      ]
+    }
+  ],
+  "results": {
+    "lexer/pom.xml": [
+      {
+        "type": "Email Address",
+        "filename": "lexer/pom.xml",
+        "hashed_secret": "fac2dea9e49a83a2d6ee38c580d1e5358b45efa5",
+        "is_verified": false,
+        "line_number": 131
+      }
+    ],
+    "pom.xml": [
+      {
+        "type": "Email Address",
+        "filename": "pom.xml",
+        "hashed_secret": "4559f82eb53128029fe5c67cb1bfee1e6ff17f54",
+        "is_verified": false,
+        "line_number": 148
+      },
+      {
+        "type": "Email Address",
+        "filename": "pom.xml",
+        "hashed_secret": "6e693f86ae73cb43ffc3c8aa62ed864dbac6e51b",
+        "is_verified": false,
+        "line_number": 157
+      },
+      {
+        "type": "Email Address",
+        "filename": "pom.xml",
+        "hashed_secret": "a3dd94099ed17e691d3e155074999c42f5b22a13",
+        "is_verified": false,
+        "line_number": 166
+      },
+      {
+        "type": "Email Address",
+        "filename": "pom.xml",
+        "hashed_secret": "7b5f7a2da87f5ff3a54f10fedcee5159e08d9b09",
+        "is_verified": false,
+        "line_number": 175
+      }
+    ],
+    "service/src/main/java/gov/nasa/pds/api/registry/configuration/OpenApiConfiguration.java": [
+      {
+        "type": "Email Address",
+        "filename": "service/src/main/java/gov/nasa/pds/api/registry/configuration/OpenApiConfiguration.java",
+        "hashed_secret": "3a6d7aa49a8e4a2fe32a5cd0e53da9cb96bd8d29",
+        "is_verified": false,
+        "line_number": 30
+      }
+    ],
+    "service/src/main/resources/application.properties": [
+      {
+        "type": "Secret Keyword",
+        "filename": "service/src/main/resources/application.properties",
+        "hashed_secret": "d033e22ae348aeb5660fc2140aec35850c4da997",
+        "is_verified": false,
+        "line_number": 37
+      }
+    ],
+    "service/src/main/resources/application.properties.all": [
+      {
+        "type": "Secret Keyword",
+        "filename": "service/src/main/resources/application.properties.all",
+        "hashed_secret": "d033e22ae348aeb5660fc2140aec35850c4da997",
+        "is_verified": false,
+        "line_number": 25
+      }
+    ],
+    "terraform/variables.tf": [
+      {
+        "type": "AWS Sensitive Information (Experimental Plugin)",
+        "filename": "terraform/variables.tf",
+        "hashed_secret": "9ad897024d8c36c541d7fe84084c4e9f4df00b2a",
+        "is_verified": false,
+        "line_number": 1
+      },
+      {
+        "type": "AWS Sensitive Information (Experimental Plugin)",
+        "filename": "terraform/variables.tf",
+        "hashed_secret": "fc2e36d110ac028935e1418f4b2a33ed20517144",
+        "is_verified": false,
+        "line_number": 32
+      },
+      {
+        "type": "AWS Sensitive Information (Experimental Plugin)",
+        "filename": "terraform/variables.tf",
+        "hashed_secret": "5c9f0d35ea4e2fb8100256464591bd6b8c518a77",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "AWS Sensitive Information (Experimental Plugin)",
+        "filename": "terraform/variables.tf",
+        "hashed_secret": "76b5eee02a53026ba2bdbd4bccad34da7a3aa30f",
+        "is_verified": false,
+        "line_number": 44
+      },
+      {
+        "type": "AWS Sensitive Information (Experimental Plugin)",
+        "filename": "terraform/variables.tf",
+        "hashed_secret": "d64be144bfa295c8d95e492d59dff169eb402051",
+        "is_verified": false,
+        "line_number": 44
+      },
+      {
+        "type": "AWS Sensitive Information (Experimental Plugin)",
+        "filename": "terraform/variables.tf",
+        "hashed_secret": "55357933a7310d2db90c3fa1ed0970a7bb34ed39",
+        "is_verified": false,
+        "line_number": 62
+      }
+    ]
+  },
+  "generated_at": "2023-11-17T21:48:34Z"
+}