Skip to content
This repository has been archived by the owner on Jul 23, 2024. It is now read-only.

Commit

Permalink
Merge pull request #14 from NASA-PDS/software-issues-repo#55
Browse files Browse the repository at this point in the history 
Add secrets detection
  • Loading branch information
@jordanpadams
jordanpadams authored Nov 20, 2023
2 parents 0bcb393 + 450124c commit 5976309
Show file tree
Hide file tree
Showing 3 changed files with 354 additions and 0 deletions.
70 changes: 70 additions & 0 deletions .github/workflows/secrets-detection.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
name: Secret Detection Workflow
on:
push:
branches:
- main
pull_request:
branches:
- main

jobs:
secret-detection:
runs-on: ubuntu-latest
steps:
-
name: Checkout code
uses: actions/checkout@v4
-
name: Install necessary packages
run: |
pip install git+https://github.com/NASA-AMMOS/slim-detect-secrets.git@exp
pip install jq
-
name: Create an initial .secrets.baseline if .secrets.baseline does not exist
run: |
if [ ! -f .secrets.baseline ]; then
# This generated baseline file will only be temporarily available on the GitHub side and will not appear in the user's local files.
# Scanning an empty folder to generate an initial .secrets.baseline without secrets in the results.
echo "⚠️ No existing .secrets.baseline file detected. Creating a new blank baseline file."
mkdir empty-dir
detect-secrets scan empty-dir > .secrets.baseline
echo "✅ Blank .secrets.baseline file created successfully."
rm -r empty-dir
else
echo "✅ Existing .secrets.baseline file detected. No new baseline file will be created."
fi
-
name: Scan repository for secrets
run: |
# scripts to scan repository for new secrets
# backup the list of known secrets
cp .secrets.baseline .secrets.new
# find the secrets in the repository
detect-secrets scan --disable-plugin AbsolutePathDetectorExperimental --baseline .secrets.new \
--exclude-files '\.secrets..*' \
--exclude-files '\.pre-commit-config\.yaml' \
--exclude-files '\.git.*' \
--exclude-files 'target'
# if there is any difference between the known and newly detected secrets, break the build
# Function to compare secrets without listing them
compare_secrets() { diff <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "$1" | sort) <(jq -r '.results | keys[] as $key | "\($key),\(.[$key] | .[] | .hashed_secret)"' "$2" | sort) >/dev/null; }
# Check if there's any difference between the known and newly detected secrets
if ! compare_secrets .secrets.baseline .secrets.new; then
echo "⚠️ Attention Required! ⚠️" >&2
echo "New secrets have been detected in your recent commit. Due to security concerns, we cannot display detailed information here and we cannot proceed until this issue is resolved." >&2
echo "" >&2
echo "Please follow the steps below on your local machine to reveal and handle the secrets:" >&2
echo "" >&2
echo "1️⃣ Run the 'detect-secrets' tool on your local machine. This tool will identify and clean up the secrets. You can find detailed instructions at this link: https://nasa-ammos.github.io/slim/continuous-testing/starter-kits/#detect-secrets" >&2
echo "" >&2
echo "2️⃣ After cleaning up the secrets, commit your changes and re-push your update to the repository." >&2
echo "" >&2
echo "Your efforts to maintain the security of our codebase are greatly appreciated!" >&2
exit 1
fi
35 changes: 35 additions & 0 deletions .pre-commit-config.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Pre-Commit
# ==========
#
# Pre-Commit (https://pre-commit.com/) is a framework for handling the hooks
# for git to easily standardizez on linters, code-cleaners, security
# scanners, etc.
#
# Currently for Java repositories, we support the following hooks:
#
# - Detect Secrets (https://nasa-ammos.github.io/slim/docs/guides/software-lifecycle/security/secrets-detection/)
#
# Future hooks could include: trailing whitespace alerts, executable shebangs,
# debug statements left in code, Google code style adherence, etc.


---

repos:
-
repo: https://github.com/NASA-AMMOS/slim-detect-secrets
# using commit id for now, will change to tag when official version is released
rev: 91e097ad4559ae6ab785c883dc5ed989202c7fbe
hooks:
- id: detect-secrets
args:
- '--baseline'
- '.secrets.baseline'
- --exclude-files '\.secrets..*'
- --exclude-files '\.git.*'
- --exclude-files '\.pre-commit-config\.yaml'
- --exclude-files 'target'

...

# -*- mode: YAML; tab-width: 4 -*-
249 changes: 249 additions & 0 deletions .secrets.baseline
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,249 @@
{
"version": "1.4.0",
"plugins_used": [
{
"name": "ArtifactoryDetector"
},
{
"name": "AWSKeyDetector"
},
{
"name": "AWSSensitiveInfoDetectorExperimental"
},
{
"name": "AzureStorageKeyDetector"
},
{
"name": "Base64HighEntropyString",
"limit": 4.5
},
{
"name": "BasicAuthDetector"
},
{
"name": "CloudantDetector"
},
{
"name": "DiscordBotTokenDetector"
},
{
"name": "EmailAddressDetector"
},
{
"name": "GitHubTokenDetector"
},
{
"name": "HexHighEntropyString",
"limit": 3.0
},
{
"name": "IbmCloudIamDetector"
},
{
"name": "IbmCosHmacDetector"
},
{
"name": "IPPublicDetector"
},
{
"name": "JwtTokenDetector"
},
{
"name": "KeywordDetector",
"keyword_exclude": ""
},
{
"name": "MailchimpDetector"
},
{
"name": "NpmDetector"
},
{
"name": "PrivateKeyDetector"
},
{
"name": "SendGridDetector"
},
{
"name": "SlackDetector"
},
{
"name": "SoftlayerDetector"
},
{
"name": "SquareOAuthDetector"
},
{
"name": "StripeDetector"
},
{
"name": "TwilioKeyDetector"
}
],
"filters_used": [
{
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
},
{
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
"min_level": 2
},
{
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
},
{
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
},
{
"path": "detect_secrets.filters.heuristic.is_lock_file"
},
{
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
},
{
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
},
{
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
},
{
"path": "detect_secrets.filters.heuristic.is_sequential_string"
},
{
"path": "detect_secrets.filters.heuristic.is_swagger_file"
},
{
"path": "detect_secrets.filters.heuristic.is_templated_secret"
},
{
"path": "detect_secrets.filters.regex.should_exclude_file",
"pattern": [
"\\.secrets..*",
"\\.git.*",
"\\.pre-commit-config\\.yaml",
"target"
]
}
],
"results": {
"src/changes/changes.xml": [
{
"type": "Email Address",
"filename": "src/changes/changes.xml",
"hashed_secret": "1ac7d6deddaec3bd29b1f559a573231d20d764fd",
"is_verified": false,
"line_number": 6
}
],
"src/site/xdoc/index.xml": [
{
"type": "Email Address",
"filename": "src/site/xdoc/index.xml",
"hashed_secret": "1ac7d6deddaec3bd29b1f559a573231d20d764fd",
"is_verified": false,
"line_number": 6
},
{
"type": "Email Address",
"filename": "src/site/xdoc/index.xml",
"hashed_secret": "3a6d7aa49a8e4a2fe32a5cd0e53da9cb96bd8d29",
"is_verified": false,
"line_number": 36
}
],
"src/site/xdoc/install/index-win.xml.vm": [
{
"type": "Email Address",
"filename": "src/site/xdoc/install/index-win.xml.vm",
"hashed_secret": "bf1bfc3f1f5b1a63361b4c29a798ea62be348864",
"is_verified": false,
"line_number": 6
},
{
"type": "Email Address",
"filename": "src/site/xdoc/install/index-win.xml.vm",
"hashed_secret": "1ac7d6deddaec3bd29b1f559a573231d20d764fd",
"is_verified": false,
"line_number": 7
}
],
"src/site/xdoc/install/index.xml.vm": [
{
"type": "Email Address",
"filename": "src/site/xdoc/install/index.xml.vm",
"hashed_secret": "1ac7d6deddaec3bd29b1f559a573231d20d764fd",
"is_verified": false,
"line_number": 6
}
],
"src/site/xdoc/operate/index-ref.xml": [
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/index-ref.xml",
"hashed_secret": "bf1bfc3f1f5b1a63361b4c29a798ea62be348864",
"is_verified": false,
"line_number": 6
},
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/index-ref.xml",
"hashed_secret": "1ac7d6deddaec3bd29b1f559a573231d20d764fd",
"is_verified": false,
"line_number": 7
}
],
"src/site/xdoc/operate/index.xml.vm": [
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/index.xml.vm",
"hashed_secret": "bf1bfc3f1f5b1a63361b4c29a798ea62be348864",
"is_verified": false,
"line_number": 6
},
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/index.xml.vm",
"hashed_secret": "1ac7d6deddaec3bd29b1f559a573231d20d764fd",
"is_verified": false,
"line_number": 7
}
],
"src/site/xdoc/operate/reports/index-compare.xml": [
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/reports/index-compare.xml",
"hashed_secret": "bf1bfc3f1f5b1a63361b4c29a798ea62be348864",
"is_verified": false,
"line_number": 6
}
],
"src/site/xdoc/operate/reports/index-ingest.xml": [
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/reports/index-ingest.xml",
"hashed_secret": "34bd97e5b6ef9dfb16a92eb3b2cc21245d5b35bb",
"is_verified": false,
"line_number": 6
}
],
"src/site/xdoc/operate/reports/index-validate.xml": [
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/reports/index-validate.xml",
"hashed_secret": "bf1bfc3f1f5b1a63361b4c29a798ea62be348864",
"is_verified": false,
"line_number": 10
}
],
"src/site/xdoc/operate/reports/index.xml": [
{
"type": "Email Address",
"filename": "src/site/xdoc/operate/reports/index.xml",
"hashed_secret": "bf1bfc3f1f5b1a63361b4c29a798ea62be348864",
"is_verified": false,
"line_number": 6
}
]
},
"generated_at": "2023-11-20T16:43:01Z"
}

0 comments on commit 5976309

Please sign in to comment.