Skip to content

Commit 81fbbc1

Browse files
therealdwrighttherealdwright
committed
fix: update the base commit trufflehog starts checking from
1 parent 1c6114d commit 81fbbc1

File tree

3 files changed

+122
-128
lines changed

3 files changed

+122
-128
lines changed

‎action.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
name: Trufflehog PR Commenter
22
description: Take trufflehog JSON output and comment violations on a PR
33
inputs:
4+
commit:
5+
description: The commit from which to check
6+
required: true
7+
default: ${{ github.event.repository.default_branch }}
48
secrets-file:
59
description: Path to save Trufflehog JSON output
610
required: true

‎index.js‎

Lines changed: 105 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
const axios = require("axios");
22
const core = require("@actions/core");
33
const exec = require("@actions/exec");
4-
const fs = require('fs');
4+
const fs = require("fs");
55
const tar = require("tar");
66
const { Octokit } = require("@octokit/rest");
77

88
const token = process.env["GITHUB_TOKEN"];
99
const octokit = new Octokit({ auth: `token ${token}` });
1010

11+
const commit = core.getInput("commit");
1112
const filePath = core.getInput("secrets-file");
1213

1314
async function downloadFile(url, outputPath) {
@@ -20,142 +21,128 @@ async function downloadFile(url, outputPath) {
2021
});
2122
}
2223

24+
async function checkForSecrets() {
25+
let secretsDetected = false;
26+
27+
const data = await fs.promises.readFile(filePath, "utf8");
28+
if (!data || data.trim().length === 0) {
29+
console.log("No data or empty file found, skipping processing...");
30+
return secretsDetected;
31+
}
32+
33+
const jsonData = JSON.parse(data);
34+
35+
if (
36+
jsonData &&
37+
jsonData.SourceMetadata &&
38+
jsonData.SourceMetadata.Data &&
39+
jsonData.SourceMetadata.Data.Git &&
40+
jsonData.SourceMetadata.Data.Git.file
41+
) {
42+
secretsDetected = true;
43+
44+
const repoData = getRepoData(jsonData.SourceMetadata.Data.Git.repository);
45+
if (!repoData) {
46+
console.log("No repo data found, skipping processing...");
47+
return secretsDetected;
48+
}
49+
50+
const commentBody = `🚨 Secret Detected 🚨\nSecret detected at line ${jsonData.SourceMetadata.Data.Git.line} in file ${jsonData.SourceMetadata.Data.Git.file}. Please review.`;
51+
52+
const prs = await octokit.pulls.list({
53+
owner: repoData.owner,
54+
repo: repoData.repo,
55+
});
56+
57+
for (const pr of prs.data) {
58+
if (pr.state === "open") {
59+
const commitId = await octokit.repos.getCommit({
60+
owner: repoData.owner,
61+
repo: repoData.repo,
62+
ref: pr.head.sha,
63+
});
64+
65+
await octokit.pulls.createReviewComment({
66+
owner: repoData.owner,
67+
repo: repoData.repo,
68+
pull_number: pr.number,
69+
body: commentBody,
70+
commit_id: commitId.data.sha,
71+
path: jsonData.SourceMetadata.Data.Git.file,
72+
line: jsonData.SourceMetadata.Data.Git.line,
73+
side: "RIGHT", // assuming the secret was added, not removed
74+
});
75+
}
76+
}
77+
}
78+
return secretsDetected;
79+
}
80+
81+
function getRepoData(repoUrl) {
82+
const regex =
83+
/(?:git@github\.com:|https:\/\/github.com\/)(.+)\/(.+)(?:\.git)?/i;
84+
const match = regex.exec(repoUrl);
85+
86+
if (!match) {
87+
console.log(`No match found for repoUrl: ${repoUrl}`);
88+
return null;
89+
}
90+
91+
return {
92+
owner: match[1],
93+
repo: match[2],
94+
};
95+
}
96+
2397
async function run() {
2498
try {
2599
const tarballPath = "./trufflehog.tar.gz";
26100
await downloadFile(
27101
"https://github.com/trufflesecurity/trufflehog/releases/download/v3.40.0/trufflehog_3.40.0_linux_amd64.tar.gz",
28102
tarballPath
29103
);
30-
31-
// Extract TruffleHog tarball
32104
await tar.x({ file: tarballPath });
33105

34-
// Get the path for the output file from the action's inputs
35106
const secretsFilePath = core.getInput("secrets-file");
36107

37-
let output = '';
38-
let errorOutput = '';
39-
40-
const options = {};
41-
options.listeners = {
108+
let output = "";
109+
const options = {
110+
listeners: {
42111
stdout: (data) => {
43-
output += data.toString();
112+
fs.appendFileSync(secretsFilePath, data.toString());
44113
},
45114
stderr: (data) => {
46-
errorOutput += data.toString();
47-
}
115+
console.error(data.toString());
116+
},
117+
},
48118
};
49119

50-
await exec.exec(`./trufflehog`, [
51-
"git",
52-
"file://./",
53-
"--since-commit",
54-
`${process.env.GITHUB_SHA}`,
55-
"--branch",
56-
"HEAD",
57-
"--fail",
58-
"--no-update",
59-
"--json",
60-
"--no-verification"
61-
], options);
62-
63-
if (errorOutput) {
64-
// Handle the error output if necessary
65-
console.error(errorOutput);
120+
try {
121+
await exec.exec(
122+
`./trufflehog`,
123+
[
124+
"git",
125+
"file://./",
126+
"--since-commit",
127+
`${commit}`,
128+
"--branch",
129+
"HEAD",
130+
"--fail",
131+
"--no-update",
132+
"--json",
133+
"--no-verification",
134+
],
135+
options
136+
);
137+
fs.writeFileSync(secretsFilePath, output);
138+
} catch (error) {
139+
console.error(`Error executing trufflehog: ${error}`);
66140
}
67141

68-
fs.writeFileSync(secretsFilePath, output);
69-
70-
fs.readFile(filePath, "utf8", async (err, data) => {
71-
if (err) {
72-
if (!data) {
73-
console.log("No data found, skipping processing...");
74-
} else {
75-
console.log(`Error reading file from disk: ${err}`);
76-
}
77-
return;
78-
}
79-
80-
if (data.trim().length === 0) {
81-
console.log("Empty file found, skipping processing...");
82-
return;
83-
}
84-
85-
try {
86-
const jsonData = JSON.parse(data);
87-
88-
const repoData = getRepoData(
89-
jsonData.SourceMetadata.Data.Git.repository
90-
);
91-
if (!repoData) {
92-
console.log("No repo data found, skipping processing...");
93-
return;
94-
}
95-
96-
const commentBody = `🚨 Secret Detected 🚨\nSecret detected at line ${jsonData.SourceMetadata.Data.Git.line} in file ${jsonData.SourceMetadata.Data.Git.file}. Please review.`;
97-
98-
try {
99-
const prs = await octokit.pulls.list({
100-
owner: repoData.owner,
101-
repo: repoData.repo,
102-
});
103-
104-
for (const pr of prs.data) {
105-
if (pr.state === "open") {
106-
const commitId = await octokit.repos.getCommit({
107-
owner: repoData.owner,
108-
repo: repoData.repo,
109-
ref: pr.head.sha,
110-
});
111-
112-
await octokit.pulls.createReviewComment({
113-
owner: repoData.owner,
114-
repo: repoData.repo,
115-
pull_number: pr.number,
116-
body: commentBody,
117-
commit_id: commitId.data.sha,
118-
path: jsonData.SourceMetadata.Data.Git.file,
119-
line: jsonData.SourceMetadata.Data.Git.line,
120-
side: "RIGHT", // assuming the secret was added, not removed
121-
});
122-
}
123-
}
124-
} catch (e) {
125-
if (
126-
e.status === 422 &&
127-
e.message.includes("PullRequestReviewComment") &&
128-
e.message.includes("pull_request_review_thread.path") &&
129-
e.message.includes("pull_request_review_thread.diff_hunk")
130-
) {
131-
// Ignore the specific error relating to pull_request_review_thread.diff_hunk
132-
} else if (e.status) {
133-
console.log(`GitHub returned an error: ${e.status}`);
134-
console.log(e.message);
135-
} else {
136-
console.log("Error occurred", e);
137-
}
138-
}
139-
} catch (e) {
140-
console.log("Error parsing JSON:", e);
141-
}
142-
});
143-
144-
function getRepoData(repoUrl) {
145-
// This regex will handle both SSH and HTTPS URLs
146-
const regex =
147-
/(?:git@github\.com:|https:\/\/github.com\/)(.+)\/(.+)(?:\.git)?/i;
148-
const match = regex.exec(repoUrl);
149-
150-
if (!match) {
151-
console.log(`No match found for repoUrl: ${repoUrl}`);
152-
return null;
153-
}
142+
const secretsFound = await checkForSecrets();
154143

155-
return {
156-
owner: match[1],
157-
repo: match[2],
158-
};
144+
if (secretsFound) {
145+
core.setFailed("Secrets detected in the repository.");
159146
}
160147
} catch (error) {
161148
core.setFailed(`Action failed with error: ${error}`);

‎node_modules/jsonparse/package.json‎

Lines changed: 13 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)