Skip to content

Commit 02822f7

Browse files
theangrytech-gittheangrytech-git
authored
Added file from workflow
Added trufflehog and gitleaks yml's to repo so they can be run separately if needed
1 parent 0f8ba86 commit 02822f7

File tree

2 files changed

+211
-0
lines changed

2 files changed

+211
-0
lines changed

‎msdo-gitleaks.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: msdo-gitleaks-secret-scanning
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
branch:
7+
required: false
8+
type: string
9+
default: 'main'
10+
secrets:
11+
GH_TOKEN:
12+
required: false
13+
14+
jobs:
15+
gitleaks-scan:
16+
name: Gitleaks Secret Scan
17+
runs-on: ubuntu-latest
18+
19+
permissions:
20+
contents: read
21+
id-token: write
22+
actions: read
23+
security-events: write
24+
25+
steps:
26+
- name: Checkout repository manually
27+
run: |
28+
git clone https://github.com/${{ github.repository }} .
29+
git checkout ${{ github.ref_name }}
30+
31+
- name: Fetch Gitleaks config from MSDO
32+
#This section will need to be edited to match wherever the repo will be copied to
33+
run: |
34+
echo "Fetching .gitleaks.toml from MSDO repo..."
35+
curl -sSL https://raw.githubusercontent.com/theangrytech-git/MSDO/main/gitleaks.toml -o .gitleaks.toml
36+
37+
- name: Run Gitleaks
38+
run: |
39+
echo "Downloading Gitleaks..."
40+
curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz -o gitleaks.tar.gz
41+
tar -xzf gitleaks.tar.gz gitleaks
42+
chmod +x gitleaks
43+
./gitleaks version
44+
45+
echo " Running Gitleaks scan..."
46+
./gitleaks detect \
47+
--source=. \
48+
--config=.gitleaks.toml \
49+
--report-format sarif \
50+
--report-path=gitleaks.sarif \
51+
--exit-code 0
52+
53+
- name: Upload SARIF to GitHub Code Scanning
54+
if: github.repository_visibility == 'public'
55+
run: |
56+
echo "Compressing and uploading SARIF..."
57+
if [ ! -f "gitleaks.sarif" ]; then
58+
echo "SARIF file not found"
59+
exit 0
60+
fi
61+
62+
gzip -c gitleaks.sarif | base64 -w 0 > gitleaks.sarif.base64
63+
encoded_sarif=$(cat gitleaks.sarif.base64)
64+
65+
curl -s -X POST \
66+
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
67+
-H "Accept: application/vnd.github+json" \
68+
-H "Content-Type: application/json" \
69+
https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs \
70+
-d @- <<EOF
71+
{
72+
"commit_sha": "${{ github.sha }}",
73+
"ref": "${{ github.ref }}",
74+
"sarif": "$encoded_sarif",
75+
"checkout_uri": "https://github.com/${{ github.repository }}",
76+
"tool_name": "Gitleaks"
77+
}
78+
EOF

‎msdo-trufflehog.yml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: trufflehog-secret-scanning
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
GH_TOKEN:
7+
required: false
8+
workflow_dispatch:
9+
10+
jobs:
11+
trufflehog-scan:
12+
name: TruffleHog Secret Scan
13+
runs-on: ubuntu-latest
14+
15+
permissions:
16+
contents: read
17+
id-token: write
18+
actions: read
19+
security-events: write
20+
21+
steps:
22+
- name: Checkout repository
23+
run: |
24+
git clone https://github.com/${{ github.repository }} .
25+
git checkout ${{ github.ref_name }}
26+
27+
- name: Install jq (if needed)
28+
run: sudo apt-get install -y jq
29+
30+
- name: Install TruffleHog (v3+ CLI)
31+
run: |
32+
echo "Fetching latest TruffleHog release asset for Linux..."
33+
34+
ASSET_URL=$(curl -s https://api.github.com/repos/trufflesecurity/trufflehog/releases/latest \
35+
| jq -r '.assets[] | select(.name | test("linux_amd64.tar.gz$")) | .browser_download_url')
36+
37+
if [ -z "$ASSET_URL" ]; then
38+
echo "Could not find Linux binary asset for TruffleHog. Exiting."
39+
exit 1
40+
fi
41+
42+
echo "Downloading from $ASSET_URL"
43+
curl -sSL -o trufflehog.tar.gz "$ASSET_URL"
44+
tar -xzf trufflehog.tar.gz
45+
chmod +x trufflehog
46+
file trufflehog
47+
sudo mv trufflehog /usr/local/bin/
48+
trufflehog --version
49+
50+
- name: Show files to be scanned
51+
run: |
52+
echo "Files that will be scanned:"
53+
find . -type f \( -name "*.tf" -o -name "*.tfvars" -o -name "*.js" -o -name "*.jsx" -o -name "*.ts" -o -name "*.tsx" -o -name "*.py" -o -name "*.json" -o -name "*.yml" -o -name "*.yaml" -o -name "*.bicep" -o -name "*.cs" -o -name "*.csproj" \)
54+
55+
- name: Run TruffleHog and generate JSON report
56+
run: |
57+
echo "\.terraform\.lock\.hcl$" > exclude-paths.txt
58+
trufflehog filesystem . \
59+
--json \
60+
-x exclude-paths.txt \
61+
> trufflehog-findings.json || true
62+
63+
- name: Convert TruffleHog findings to SARIF format
64+
if: github.repository_visibility == 'public'
65+
run: |
66+
echo "import json" > convert_to_sarif.py
67+
echo "" >> convert_to_sarif.py
68+
echo "try:" >> convert_to_sarif.py
69+
echo " with open('trufflehog-findings.json') as f:" >> convert_to_sarif.py
70+
echo " findings = [json.loads(line) for line in f if line.strip()]" >> convert_to_sarif.py
71+
echo "except Exception as e:" >> convert_to_sarif.py
72+
echo " print('Failed to parse findings:', e)" >> convert_to_sarif.py
73+
echo " findings = []" >> convert_to_sarif.py
74+
echo "" >> convert_to_sarif.py
75+
echo "sarif = {" >> convert_to_sarif.py
76+
echo " 'version': '2.1.0'," >> convert_to_sarif.py
77+
echo " 'runs': [{" >> convert_to_sarif.py
78+
echo " 'tool': {" >> convert_to_sarif.py
79+
echo " 'driver': {" >> convert_to_sarif.py
80+
echo " 'name': 'TruffleHog'," >> convert_to_sarif.py
81+
echo " 'informationUri': 'https://github.com/trufflesecurity/trufflehog'," >> convert_to_sarif.py
82+
echo " 'rules': []" >> convert_to_sarif.py
83+
echo " }" >> convert_to_sarif.py
84+
echo " }," >> convert_to_sarif.py
85+
echo " 'results': []" >> convert_to_sarif.py
86+
echo " }]" >> convert_to_sarif.py
87+
echo "}" >> convert_to_sarif.py
88+
echo "" >> convert_to_sarif.py
89+
echo "seen_rules = set()" >> convert_to_sarif.py
90+
echo "" >> convert_to_sarif.py
91+
echo "for finding in findings:" >> convert_to_sarif.py
92+
echo " reason = finding.get('reason', 'Secret detected')" >> convert_to_sarif.py
93+
echo " path = finding.get('path', '')" >> convert_to_sarif.py
94+
echo " line = finding.get('line', 1)" >> convert_to_sarif.py
95+
echo " strings_found = ', '.join(finding.get('stringsFound', []))" >> convert_to_sarif.py
96+
echo " rule_id = f'trufflehog-{reason.replace(\" \", \"-\")[:64]}'" >> convert_to_sarif.py
97+
echo " if rule_id not in seen_rules:" >> convert_to_sarif.py
98+
echo " sarif['runs'][0]['tool']['driver']['rules'].append({" >> convert_to_sarif.py
99+
echo " 'id': rule_id," >> convert_to_sarif.py
100+
echo " 'name': reason" >> convert_to_sarif.py
101+
echo " })" >> convert_to_sarif.py
102+
echo " seen_rules.add(rule_id)" >> convert_to_sarif.py
103+
echo " sarif['runs'][0]['results'].append({" >> convert_to_sarif.py
104+
echo " 'ruleId': rule_id," >> convert_to_sarif.py
105+
echo " 'level': 'warning'," >> convert_to_sarif.py
106+
echo " 'message': {" >> convert_to_sarif.py
107+
echo " 'text': f'{reason} in {path} at line {line}: {strings_found}'" >> convert_to_sarif.py
108+
echo " }," >> convert_to_sarif.py
109+
echo " 'locations': [{" >> convert_to_sarif.py
110+
echo " 'physicalLocation': {" >> convert_to_sarif.py
111+
echo " 'artifactLocation': { 'uri': path }," >> convert_to_sarif.py
112+
echo " 'region': { 'startLine': line }" >> convert_to_sarif.py
113+
echo " }" >> convert_to_sarif.py
114+
echo " }]" >> convert_to_sarif.py
115+
echo " })" >> convert_to_sarif.py
116+
echo "" >> convert_to_sarif.py
117+
echo "with open('trufflehog.sarif', 'w') as out:" >> convert_to_sarif.py
118+
echo " json.dump(sarif, out)" >> convert_to_sarif.py
119+
120+
python3 convert_to_sarif.py
121+
122+
- name: Upload TruffleHog SARIF to GitHub Code Scanning
123+
if: github.repository_visibility == 'public'
124+
run: |
125+
gzip -c trufflehog.sarif | base64 -w 0 > trufflehog.sarif.base64
126+
encoded_sarif=$(cat trufflehog.sarif.base64)
127+
128+
curl -s -X POST \
129+
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
130+
-H "Accept: application/vnd.github+json" \
131+
-H "Content-Type: application/json" \
132+
https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs \
133+
-d "{\"commit_sha\": \"${{ github.sha }}\",\"ref\": \"${{ github.ref }}\",\"sarif\": \"$encoded_sarif\",\"checkout_uri\": \"https://github.com/${{ github.repository }}\",\"tool_name\": \"TruffleHog\"}"

0 commit comments

Comments
 (0)