From ca099dc02f128d1ddfdf6b2cbd3438a773ff96bf Mon Sep 17 00:00:00 2001 From: Frank-Howard Date: Wed, 11 Dec 2024 13:35:16 +0000 Subject: [PATCH 1/3] Add Secret Scanning pre-commit --- .pre-commit-config.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .pre-commit-config.yaml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..448083d --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,10 @@ +repos: +- repo: https://github.com/trufflesecurity/trufflehog.git + rev: "v3.84.2" + hooks: + - id: trufflehog + name: TruffleHog + description: Detect secrets in your data. + entry: bash -c 'trufflehog git file://. --since-commit HEAD --only-verified --fail --no-update' + language: system + stages: ["pre-commit", "pre-push"] From 44fed676f923c20a33b6623d729dc151bc0e469b Mon Sep 17 00:00:00 2001 From: Frank-Howard Date: Wed, 11 Dec 2024 14:50:49 +0000 Subject: [PATCH 2/3] Add no commit to main --- .pre-commit-config.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 448083d..6755b23 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,4 +1,8 @@ repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: "v5.0.0" + hooks: + - id: no-commit-to-branch - repo: https://github.com/trufflesecurity/trufflehog.git rev: "v3.84.2" hooks: From 8099ac0a7a8b45dad654c1b3c5dcf6f24d02d43a Mon Sep 17 00:00:00 2001 From: Frank-Howard Date: Wed, 11 Dec 2024 16:39:19 +0000 Subject: [PATCH 3/3] Add secret scanning github action --- .github/workflows/secret_scanning.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/workflows/secret_scanning.yml diff --git a/.github/workflows/secret_scanning.yml b/.github/workflows/secret_scanning.yml new file mode 100644 index 0000000..d73b4db --- /dev/null +++ b/.github/workflows/secret_scanning.yml @@ -0,0 +1,10 @@ +name: "Secret Scanning" +on: + push: + +jobs: + check_commits: + uses: trufflesecurity/trufflehog@main + with: + extra_args: --results=verified,unknown +