secret scanning workflow

Author: mdtro

.github/workflows/secret-scan.yml

@@ -0,0 +1,74 @@
+name: Secret Scan
+
+on: [pull_request]
+
+jobs:
+  secret-scan:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: "read"
+
+    outputs:
+      latest_release: ${{ steps.trufflehog_release.outputs.latest_release }}
+      latest_tag_name: ${{ steps.trufflehog_release.outputs.latest_tag_name }}
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Cosign
+        uses: sigstore/[email protected]
+
+      - name: Pin Trufflehog to a know good release
+        id: trufflehog_release
+        shell: bash
+        # run: |
+        #   LATEST_TAG_NAME=$(curl -s https://api.github.com/repos/trufflesecurity/trufflehog/releases/latest | jq -r .name)
+        #   LATEST_RELEASE=$(echo ${LATEST_TAG_NAME:1})
+        #   echo "latest_tag_name=$LATEST_TAG_NAME" >> "$GITHUB_OUTPUT"
+        #   echo "latest_release=$LATEST_RELEASE" >> "$GITHUB_OUTPUT"
+        run: |
+          echo "latest_tag_name=v3.80.3" >> "$GITHUB_OUTPUT"
+          echo "latest_release=3.80.3" >> "$GITHUB_OUTPUT"
+
+      - name: Download and verify TruffleHog release
+        run: |
+          curl -sLO https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
+          curl -sLO https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem
+          curl -sLO https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig
+          curl -sLO https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz
+
+          cosign verify-blob trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt \
+            --certificate trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem \
+            --signature trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig \
+            --certificate-identity-regexp 'https://github\.com/trufflesecurity/trufflehog/\.github/workflows/.+' \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
+
+          sha256sum --ignore-missing -c trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt 
+
+
+      - name: Extract TruffleHog
+        run: |
+          tar xzf trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz -C /usr/local/bin
+          chmod +x /usr/local/bin/trufflehog
+
+      - name: Run TruffleHog scan
+        continue-on-error: true
+        id: scan
+        run: |
+          if [ -e .secret_scan_ignore ]; then
+            trufflehog git file://. --only-verified --github-actions --fail --exclude-paths=.secret_scan_ignore --exclude-detectors="datadogtoken"
+          else
+            trufflehog git file://. --only-verified --github-actions --fail --exclude-detectors="datadogtoken"
+          fi
+      - name: Send Alert to Panther
+        id: alert
+        if: steps.scan.outcome != 'success'
+        run: |
+          curl "${{vars.SECRET_SCAN_PANTHER_WEBHOOK_URL}}" \
+            --header "Authorization: Bearer ${{ secrets.SECRET_SCAN_PANTHER_WEBHOOK_HEADER }}" \
+            --data '{"event":"github_secret_scanning_failed", createdAt:"${{ github.event.pull_request.created_at }}", "repo":"${{ github.repository }}","pull_request":"https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}"","actor":"${{ github.event.pull_request.user.login }}"}'
+      - name: Fail workflow if secret detected
+        if: steps.scan.outcome != 'success'
+        run: exit 1