diff --git a/.github/workflows/trufflehog-secret-scan.yaml b/.github/workflows/trufflehog-secret-scan.yaml new file mode 100644 index 0000000..e4e198d --- /dev/null +++ b/.github/workflows/trufflehog-secret-scan.yaml @@ -0,0 +1,70 @@ +name: CI +on: push +jobs: + trufflehog: + runs-on: ubuntu-latest + env: + ORG_NAME: ${{ secrets.TRUFFLEHOG_ORG_NAME }} + PAT_TOKEN: ${{ secrets.PAT_TOKEN }} + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Secret Scanning + run: | + echo $GITHUB_REPOSITORY + echo "Branch name is ${GITHUB_REF##*/}" + docker run --rm -e DOCKER_TTY=0 -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo=https://github.com/$GITHUB_REPOSITORY --token=$PAT_TOKEN --only-verified > trufflehog_result.txt + # Add error handling if the previous command fails + if [ $? -ne 0 ]; then + echo "Trufflehog execution failed" + exit 1 + fi + + - name: Upload Trufflehog Result + uses: actions/upload-artifact@v2 + with: + name: TruffleHog Results + path: trufflehog_result.txt + + - name: Add output to Job Summary + run: cat trufflehog_result.txt >> $GITHUB_STEP_SUMMARY + shell: bash + + - name: Read comment from file + id: read-comment + run: | + COMMENT=$(cat trufflehog_result.txt) + echo "::set-output name=comment::$COMMENT" + + - name: Add a comment to the PR + env: + GH_TOKEN: ${{ secrets.PAT_TOKEN }} + COMMENT: ${{ steps.read-comment.outputs.comment }} + PULL_NUMBER: ${{ github.event.number }} + COMMIT_ID: ${{ steps.commit_sha.outputs.sha }} + run: | + echo PULL_NUMBER + echo ${{ github.event.number }} + echo COMMIT_ID + echo ${{ steps.commit_sha.outputs.sha }} + curl -L \ + -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + https://api.github.com/repos/${{ github.repository }}/pulls/${ PULL_NUMBER }/comments \ + -d '{"body":"Great stuff!","commit_id":"$COMMIT_ID","path":"trufflehog_result.txt","start_line":1,"start_side":"RIGHT","line":2,"side":"RIGHT"}' + + - name: Check file size + run: | + FILE_PATH="trufflehog_result.txt" + FILE_SIZE=$(stat -c %s "$FILE_PATH") + + if [ "$FILE_SIZE" -eq 0 ]; then + echo "No Secrets Found" >> $GITHUB_STEP_SUMMARY + exit 0 + else + echo "File size is not zero." + exit 1 + fi diff --git a/PAT b/PAT index 72d6997..6ba1f1d 100644 --- a/PAT +++ b/PAT @@ -1,2 +1,2 @@ [default] -PAT = ***REMOVED*** \ No newline at end of file +PAT = ***REMOVED*** diff --git a/keys b/keys index a019b22..e00804f 100644 --- a/keys +++ b/keys @@ -6,7 +6,7 @@ Private key: -----BEGIN OPENSSH PRIVATE KEY----- ***REMOVED***NIZuun xgLkM8KuzfmQuRAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDe3Al0EMPz -utVNk5DixaYrGMK56RqUoqGBinke6SWVWmqom1lBcJWzor6HlnMRPPr7YCEsJKL4IpuVwu +utVNk5DixaYrGMK56RqUoqGBinke6SWVWmqom1lBcJWzor6HlnMRPPr7YCEsJKL4IpuVwv inRa5kdtNTyM7yyQTSR2xXCS0fUItNuq8pUktsH8VUggpMeew8hJv7rFA7tnIg3UXCl6iF OLZKbDA5aa24idpcD8b1I9/RzTOB1fu0of5xd9vgODzGw5JvHQSJ0FaA42aNBMGwrDhDB3 sgnRNdWf6NNIh8KpXXMKJADf3klsyn6He8L2bPMp8a4wwys2YB35p5zQ0JURovsdewlOxH