mirror of
https://github.com/pezkuwichain/pezkuwi-wallet-utils.git
synced 2026-10-21 19:26:24 +00:00
SatoshiQaziMuhammed
d7585a346c
* ci(security): scan new commits on push/PR and the current tree weekly `base: main` made every push to main rescan the whole history. Nova's own Infura keys, removed from the files in #72 but still in history and live, kept Secret Scan red on every push since at least 2026-09-21, so a new leak would have read as the same old red. - push and pull_request: no `base`, so the action scans only the commits the event brings (before..after, or the PR's base..head) - schedule: scan a `git archive HEAD` copy of today's tree - pin the action to v3.99.2 by commit and the image to 3.99.2 (was @main and latest) * ci(security): exempt the TruffleHog action from the AGPL licence denial Pinning the action made dependency review evaluate it for the first time. It runs unmodified in CI and is not linked into or shipped with anything.
96 lines
3.2 KiB
YAML
96 lines
3.2 KiB
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: '0 6 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: Secret Scan
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
# Push and pull_request scan only the commits they bring: the action picks
|
|
# the range from the event. `base: main` made a push to main rescan the
|
|
# whole history, where Nova's own Infura keys (removed from the files in
|
|
# #72, still live and public upstream) kept this job red on every push
|
|
# since September, so a new leak would have looked like the old red.
|
|
- name: TruffleHog Secret Scan (new commits)
|
|
if: github.event_name != 'schedule'
|
|
uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
|
|
with:
|
|
path: ./
|
|
version: 3.99.2
|
|
extra_args: --only-verified
|
|
|
|
# The weekly run checks what is in the tree today, not the history.
|
|
- name: TruffleHog Secret Scan (current tree)
|
|
if: github.event_name == 'schedule'
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/tree"
|
|
git archive HEAD | tar -x -C "$RUNNER_TEMP/tree"
|
|
docker run --rm -v "$RUNNER_TEMP/tree:/tree" ghcr.io/trufflesecurity/trufflehog:3.99.2 \
|
|
filesystem /tree --fail --no-update --github-actions --only-verified
|
|
|
|
hardcoded-secrets:
|
|
name: Hardcoded Secret Detection
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Scan for hardcoded secrets
|
|
run: |
|
|
FOUND=0
|
|
|
|
echo "Checking for private keys in config files..."
|
|
# "account" fields hold public 32-byte account IDs (balance-test fixtures), not private keys
|
|
if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\":"; then
|
|
echo "::error::Possible private key found"
|
|
FOUND=1
|
|
fi
|
|
|
|
echo "Checking for hardcoded credentials..."
|
|
if grep -rn --include="*.py" --include="*.json" -iE "(password|secret_key|api_key)\s*[:=]\s*['\"][^'\"]{8,}" . | grep -v node_modules; then
|
|
echo "::error::Possible hardcoded credential found"
|
|
FOUND=1
|
|
fi
|
|
|
|
if [ "$FOUND" -eq 0 ]; then
|
|
echo "No hardcoded secrets found."
|
|
else
|
|
exit 1
|
|
fi
|
|
|
|
dependency-review:
|
|
name: Dependency Review
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request'
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v4
|
|
with:
|
|
fail-on-severity: high
|
|
deny-licenses: GPL-3.0, AGPL-3.0
|
|
# TruffleHog (AGPL-3.0) is run unmodified as a CI scanner; it is not
|
|
# linked into or shipped with anything, so the licence's obligations
|
|
# do not reach this repository. Only this package is exempt.
|
|
allow-dependencies-licenses: pkg:githubactions/trufflesecurity/trufflehog
|