From 2f27ebfbf5fd90541fbd37eca02d47e5ae54818e Mon Sep 17 00:00:00 2001 From: nick-diamond Date: Wed, 11 Jun 2025 14:40:59 +0100 Subject: [PATCH 1/9] Create workflows directory --- .github/workflows/.gitkeep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 .github/workflows/.gitkeep diff --git a/.github/workflows/.gitkeep b/.github/workflows/.gitkeep new file mode 100644 index 0000000..e69de29 From 9f06b142664a0006afd7c62c47b6725d7941d063 Mon Sep 17 00:00:00 2001 From: nick-diamond Date: Wed, 11 Jun 2025 14:40:59 +0100 Subject: [PATCH 2/9] Add secret scanner workflow --- .github/workflows/secret-scanner.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/secret-scanner.yaml diff --git a/.github/workflows/secret-scanner.yaml b/.github/workflows/secret-scanner.yaml new file mode 100644 index 0000000..7acee4e --- /dev/null +++ b/.github/workflows/secret-scanner.yaml @@ -0,0 +1,16 @@ +name: "Secret Scanner" +on: + push: + pull_request: + +permissions: + contents: read + id-token: write + issues: write + pull-requests: write + +jobs: + secrets-scanner: + uses: arbor-education/gha.workflows/.github/workflows/secret-scanner-template.yaml@DOPS-12604-cicd-scanner + secrets: + JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} From f06a3f446a17261d993a527330d8612091d9b44c Mon Sep 17 00:00:00 2001 From: nick-diamond Date: Wed, 11 Jun 2025 14:41:00 +0100 Subject: [PATCH 3/9] Add pre-commit config with secret scanner hook --- .pre-commit-config.yaml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .pre-commit-config.yaml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..b0c4380 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,3 @@ +repos: + - repo: arbor-education/gha.workflows/.github/workflows/pre-commit-template.yaml + rev: v0.0.168 From 020e4c794a09eaba5cfb4e11f61c6a5de2b8a2a8 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 26 Jun 2026 09:10:53 +0000 Subject: [PATCH 4/9] DOPS-15477 Fix secret scanner workflow ref and add trufflehog pre-commit hook --- .github/workflows/secret-scanner.yaml | 2 +- .pre-commit-config.yaml | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/secret-scanner.yaml b/.github/workflows/secret-scanner.yaml index 7acee4e..b3341da 100644 --- a/.github/workflows/secret-scanner.yaml +++ b/.github/workflows/secret-scanner.yaml @@ -11,6 +11,6 @@ permissions: jobs: secrets-scanner: - uses: arbor-education/gha.workflows/.github/workflows/secret-scanner-template.yaml@DOPS-12604-cicd-scanner + uses: arbor-education/gha.workflows/.github/workflows/secret-scanner-template.yaml@v1 secrets: JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index b0c4380..54f8e9d 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,3 +1,10 @@ repos: - - repo: arbor-education/gha.workflows/.github/workflows/pre-commit-template.yaml - rev: v0.0.168 + - repo: local + hooks: + - id: trufflehog + name: TruffleHog + description: Detect secrets using TruffleHog. + entry: bash -c 'trufflehog git file://. --since-commit HEAD --results=verified --fail --no-update' + language: system + pass_filenames: false + stages: ["pre-commit", "pre-push"] From 040882be78cd41a219c8a35643988e8631704c09 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 26 Jun 2026 10:20:50 +0000 Subject: [PATCH 5/9] DOPS-15477 Consolidate pre-commit config: use gha.workflows for trufflehog and add standard hooks --- .pre-commit-config.yaml | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 54f8e9d..a1c707b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,10 +1,17 @@ repos: - - repo: local + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.2.0 + hooks: + - id: check-merge-conflict + - id: trailing-whitespace + exclude: '\.github/actions/.*/dist/.*' + - id: end-of-file-fixer + exclude: '\.github/actions/.*/dist/.*' + - id: check-json + - id: check-added-large-files + - id: check-yaml + + - repo: https://github.com/arbor-education/gha.workflows + rev: c593aa60a9207ddc5c553561f9580b25d88fe5bc hooks: - id: trufflehog - name: TruffleHog - description: Detect secrets using TruffleHog. - entry: bash -c 'trufflehog git file://. --since-commit HEAD --results=verified --fail --no-update' - language: system - pass_filenames: false - stages: ["pre-commit", "pre-push"] From 1d01a7b95d1b1b5e28896c3c036efcd897f4eb58 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 26 Jun 2026 11:21:11 +0000 Subject: [PATCH 6/9] DOPS-15477 Consolidate pre-commit config to single gha.workflows reference --- .pre-commit-config.yaml | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index a1c707b..ad88bb6 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,17 +1,6 @@ repos: - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.2.0 - hooks: - - id: check-merge-conflict - - id: trailing-whitespace - exclude: '\.github/actions/.*/dist/.*' - - id: end-of-file-fixer - exclude: '\.github/actions/.*/dist/.*' - - id: check-json - - id: check-added-large-files - - id: check-yaml - - repo: https://github.com/arbor-education/gha.workflows - rev: c593aa60a9207ddc5c553561f9580b25d88fe5bc + rev: 444cca24015f1cfcb80de1d6deb881a5ae58e30d hooks: + - id: arbor-standard - id: trufflehog From 473119ea71f51498c0af1c92cb623816cbe5200e Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 26 Jun 2026 11:53:00 +0000 Subject: [PATCH 7/9] DOPS-15477 Pin gha.workflows pre-commit ref to v2.0.51 --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ad88bb6..ffc6c06 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/arbor-education/gha.workflows - rev: 444cca24015f1cfcb80de1d6deb881a5ae58e30d + rev: v2.0.51 hooks: - id: arbor-standard - id: trufflehog From 1f770d0a541773a8d5eb5403d043dbf21dbaea02 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 26 Jun 2026 14:36:36 +0000 Subject: [PATCH 8/9] DOPS-15477 Standardise pre-commit config with canonical hooks and trufflehog install hint --- .pre-commit-config.yaml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ffc6c06..0b410b7 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,22 @@ repos: - - repo: https://github.com/arbor-education/gha.workflows - rev: v2.0.51 + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.2.0 + hooks: + - id: check-merge-conflict + - id: trailing-whitespace + exclude: '\.github/actions/.*/dist/.*' + - id: end-of-file-fixer + exclude: '\.github/actions/.*/dist/.*' + - id: check-json + - id: check-added-large-files + - id: check-yaml + + - repo: local hooks: - - id: arbor-standard - id: trufflehog + name: TruffleHog + description: Detect secrets using TruffleHog. + entry: bash -c 'if ! command -v trufflehog &>/dev/null; then echo "ERROR: trufflehog is not installed."; echo "Install it via: curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin"; exit 1; fi; trufflehog git file://. --since-commit HEAD --results=verified --fail --no-update' + language: system + pass_filenames: false + stages: ["pre-commit", "pre-push"] From 4f2293dc7e5250f868fb1b88719f08db2d8e4f70 Mon Sep 17 00:00:00 2001 From: default Date: Wed, 1 Jul 2026 08:29:17 +0000 Subject: [PATCH 9/9] =?UTF-8?q?DOPS-15477=20Fix=20secret=20name=20JIRA=5FT?= =?UTF-8?q?OKEN=20=E2=86=92=20JIRA=5FSA=5FCREATE=5FISSUE=20in=20secret=20s?= =?UTF-8?q?canner?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/secret-scanner.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yaml b/.github/workflows/secret-scanner.yaml index b3341da..81d1346 100644 --- a/.github/workflows/secret-scanner.yaml +++ b/.github/workflows/secret-scanner.yaml @@ -13,4 +13,4 @@ jobs: secrets-scanner: uses: arbor-education/gha.workflows/.github/workflows/secret-scanner-template.yaml@v1 secrets: - JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} + JIRA_SA_CREATE_ISSUE: ${{ secrets.JIRA_SA_CREATE_ISSUE }}