Skip to content

Commit 24655dc

Browse files
baywetbaywet
authored
Merge pull request #2116 from microsoftgraph/fix/secrets-scanning-workflow
Update secrets scanning baseline and workflow
2 parents cec054a + 2dc7da9 commit 24655dc

File tree

3 files changed

+151
-149
lines changed

3 files changed

+151
-149
lines changed

‎.github/workflows/gradle-build.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ jobs:
1818
java-version: 21
1919
distribution: 'temurin'
2020
cache: gradle
21-
- name: Detect Secrets
22-
uses: RobertFischer/[email protected]
21+
- name: Detect secrets
22+
run: |
23+
pip install detect-secrets
24+
git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
2325
- name: Grant Execute permission for gradlew
2426
run: chmod +x gradlew
2527
- name: Build with Gradle

‎.github/workflows/preview-and-release.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,10 @@ jobs:
3737
java-version: ${{ env.JAVA_VERSION }}
3838
distribution: ${{ env.JAVA_DISTRIBUTION}}
3939
cache: gradle
40-
- name: Easy detect-secrets
41-
uses: RobertFischer/[email protected]
40+
- name: Detect secrets
41+
run: |
42+
pip install detect-secrets
43+
git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
4244
- name: Download File
4345
run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
4446
shell: pwsh
@@ -70,8 +72,10 @@ jobs:
7072
java-version: ${{ env.JAVA_VERSION }}
7173
distribution: ${{ env.JAVA_DISTRIBUTION}}
7274
cache: gradle
73-
- name: Easy detect-secrets
74-
uses: RobertFischer/[email protected]
75+
- name: Detect secrets
76+
run: |
77+
pip install detect-secrets
78+
git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
7579
- name: Download File
7680
run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
7781
shell: pwsh

‎.secrets.baseline‎

Lines changed: 139 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -1,143 +1,139 @@
1-
{
2-
"version": "1.5.0",
3-
"plugins_used": [
4-
{
5-
"name": "ArtifactoryDetector"
6-
},
7-
{
8-
"name": "AWSKeyDetector"
9-
},
10-
{
11-
"name": "AzureStorageKeyDetector"
12-
},
13-
{
14-
"name": "Base64HighEntropyString",
15-
"limit": 4.5
16-
},
17-
{
18-
"name": "BasicAuthDetector"
19-
},
20-
{
21-
"name": "CloudantDetector"
22-
},
23-
{
24-
"name": "DiscordBotTokenDetector"
25-
},
26-
{
27-
"name": "GitHubTokenDetector"
28-
},
29-
{
30-
"name": "GitLabTokenDetector"
31-
},
32-
{
33-
"name": "HexHighEntropyString",
34-
"limit": 3.0
35-
},
36-
{
37-
"name": "IbmCloudIamDetector"
38-
},
39-
{
40-
"name": "IbmCosHmacDetector"
41-
},
42-
{
43-
"name": "IPPublicDetector"
44-
},
45-
{
46-
"name": "JwtTokenDetector"
47-
},
48-
{
49-
"name": "KeywordDetector",
50-
"keyword_exclude": ""
51-
},
52-
{
53-
"name": "MailchimpDetector"
54-
},
55-
{
56-
"name": "NpmDetector"
57-
},
58-
{
59-
"name": "OpenAIDetector"
60-
},
61-
{
62-
"name": "PrivateKeyDetector"
63-
},
64-
{
65-
"name": "PypiTokenDetector"
66-
},
67-
{
68-
"name": "SendGridDetector"
69-
},
70-
{
71-
"name": "SlackDetector"
72-
},
73-
{
74-
"name": "SoftlayerDetector"
75-
},
76-
{
77-
"name": "SquareOAuthDetector"
78-
},
79-
{
80-
"name": "StripeDetector"
81-
},
82-
{
83-
"name": "TelegramBotTokenDetector"
84-
},
85-
{
86-
"name": "TwilioKeyDetector"
87-
}
88-
],
89-
"filters_used": [
90-
{
91-
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
92-
},
93-
{
94-
"path": "detect_secrets.filters.common.is_baseline_file",
95-
"filename": ".secrets.baseline"
96-
},
97-
{
98-
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
99-
"min_level": 2
100-
},
101-
{
102-
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
103-
},
104-
{
105-
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
106-
},
107-
{
108-
"path": "detect_secrets.filters.heuristic.is_lock_file"
109-
},
110-
{
111-
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
112-
},
113-
{
114-
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
115-
},
116-
{
117-
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
118-
},
119-
{
120-
"path": "detect_secrets.filters.heuristic.is_sequential_string"
121-
},
122-
{
123-
"path": "detect_secrets.filters.heuristic.is_swagger_file"
124-
},
125-
{
126-
"path": "detect_secrets.filters.heuristic.is_templated_secret"
127-
},
128-
{
129-
"path": "detect_secrets.filters.HexHighEntropyString.should_exclude_file",
130-
"pattern": [
131-
"release-please-config.json"
132-
]
133-
},
134-
{
135-
"path": "detect_secrets.filters.regex.should_exclude_file",
136-
"pattern": [
137-
"release-please-config.json"
138-
]
139-
}
140-
],
141-
"results": {},
142-
"generated_at": "2024-05-08T12:56:29Z"
143-
}
1+
{
2+
"version": "1.5.0",
3+
"plugins_used": [
4+
{
5+
"name": "ArtifactoryDetector"
6+
},
7+
{
8+
"name": "AWSKeyDetector"
9+
},
10+
{
11+
"name": "AzureStorageKeyDetector"
12+
},
13+
{
14+
"name": "Base64HighEntropyString",
15+
"limit": 4.5
16+
},
17+
{
18+
"name": "BasicAuthDetector"
19+
},
20+
{
21+
"name": "CloudantDetector"
22+
},
23+
{
24+
"name": "DiscordBotTokenDetector"
25+
},
26+
{
27+
"name": "GitHubTokenDetector"
28+
},
29+
{
30+
"name": "GitLabTokenDetector"
31+
},
32+
{
33+
"name": "HexHighEntropyString",
34+
"limit": 3.0
35+
},
36+
{
37+
"name": "IbmCloudIamDetector"
38+
},
39+
{
40+
"name": "IbmCosHmacDetector"
41+
},
42+
{
43+
"name": "IPPublicDetector"
44+
},
45+
{
46+
"name": "JwtTokenDetector"
47+
},
48+
{
49+
"name": "KeywordDetector",
50+
"keyword_exclude": ""
51+
},
52+
{
53+
"name": "MailchimpDetector"
54+
},
55+
{
56+
"name": "NpmDetector"
57+
},
58+
{
59+
"name": "OpenAIDetector"
60+
},
61+
{
62+
"name": "PrivateKeyDetector"
63+
},
64+
{
65+
"name": "PypiTokenDetector"
66+
},
67+
{
68+
"name": "SendGridDetector"
69+
},
70+
{
71+
"name": "SlackDetector"
72+
},
73+
{
74+
"name": "SoftlayerDetector"
75+
},
76+
{
77+
"name": "SquareOAuthDetector"
78+
},
79+
{
80+
"name": "StripeDetector"
81+
},
82+
{
83+
"name": "TelegramBotTokenDetector"
84+
},
85+
{
86+
"name": "TwilioKeyDetector"
87+
}
88+
],
89+
"filters_used": [
90+
{
91+
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
92+
},
93+
{
94+
"path": "detect_secrets.filters.common.is_baseline_file",
95+
"filename": ".secrets.baseline"
96+
},
97+
{
98+
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
99+
"min_level": 2
100+
},
101+
{
102+
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
103+
},
104+
{
105+
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
106+
},
107+
{
108+
"path": "detect_secrets.filters.heuristic.is_lock_file"
109+
},
110+
{
111+
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
112+
},
113+
{
114+
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
115+
},
116+
{
117+
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
118+
},
119+
{
120+
"path": "detect_secrets.filters.heuristic.is_sequential_string"
121+
},
122+
{
123+
"path": "detect_secrets.filters.heuristic.is_swagger_file"
124+
},
125+
{
126+
"path": "detect_secrets.filters.heuristic.is_templated_secret"
127+
},
128+
{
129+
"path": "detect_secrets.filters.regex.should_exclude_file",
130+
"pattern": [
131+
"src/main/java/com/microsoft/graph/generated/.*",
132+
"release-please-config.json",
133+
"kiota-lock.json"
134+
]
135+
}
136+
],
137+
"results": {},
138+
"generated_at": "2024-08-13T14:19:43Z"
139+
}

0 commit comments

Comments
 (0)