mirror of
https://github.com/pezkuwichain/pezkuwi-wallet-utils.git
synced 2026-10-21 03:06:18 +00:00
SatoshiQaziMuhammed
8bd31ac686
The organisation's code security configuration enables CodeQL default setup, and GitHub refuses to apply it while a workflow runs CodeQL itself: the configuration failed on this repository with "Code scanning conflict". Default setup covers what this job did. The job ran the default query suite with no config file, path filters or packs, and the languages it analysed are among those default setup detects here. Default setup takes over the scan; this workflow keeps its other jobs. security-events: write served only the SARIF upload, so it goes with it. contents: read is all the remaining jobs need.
77 lines
2.0 KiB
YAML
77 lines
2.0 KiB
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: '0 6 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: Secret Scan
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: TruffleHog Secret Scan
|
|
uses: trufflesecurity/trufflehog@main
|
|
with:
|
|
path: ./
|
|
base: ${{ github.event.repository.default_branch }}
|
|
extra_args: --only-verified
|
|
|
|
hardcoded-secrets:
|
|
name: Hardcoded Secret Detection
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Scan for hardcoded secrets
|
|
run: |
|
|
FOUND=0
|
|
|
|
echo "Checking for private keys in config files..."
|
|
# "account" fields hold public 32-byte account IDs (balance-test fixtures), not private keys
|
|
if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\":"; then
|
|
echo "::error::Possible private key found"
|
|
FOUND=1
|
|
fi
|
|
|
|
echo "Checking for hardcoded credentials..."
|
|
if grep -rn --include="*.py" --include="*.json" -iE "(password|secret_key|api_key)\s*[:=]\s*['\"][^'\"]{8,}" . | grep -v node_modules; then
|
|
echo "::error::Possible hardcoded credential found"
|
|
FOUND=1
|
|
fi
|
|
|
|
if [ "$FOUND" -eq 0 ]; then
|
|
echo "No hardcoded secrets found."
|
|
else
|
|
exit 1
|
|
fi
|
|
|
|
dependency-review:
|
|
name: Dependency Review
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request'
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v4
|
|
with:
|
|
fail-on-severity: high
|
|
deny-licenses: GPL-3.0, AGPL-3.0
|