Merge pull request #13 from wgpsec/copilot/add-sensitive-info-check

Add automated secret scanning for AK/SK/passwords

Author: No-Github

.github/workflows/push-redc-templates.yml

@@ -28,8 +28,19 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           wait-interval: 10
 
+  wait-for-secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Wait for secret scanning to complete
+        uses: lewagon/wait-on-check-action@v1.3.4
+        with:
+          ref: ${{ github.ref }}
+          check-name: 'Scan for Secrets (AK/SK/Passwords)'
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 10
+
   build-and-deploy:
-    needs: wait-for-validation
+    needs: [wait-for-validation, wait-for-secret-scan]
     runs-on: ubuntu-latest
     steps:
       # 1. 拉取源码 (最新版)

.github/workflows/secret-scan.yml

@@ -0,0 +1,33 @@
+name: Secret Scanning
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  secret-scan:
+    name: Scan for Secrets (AK/SK/Passwords)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Fetch all history for better scanning
+
+      - name: TruffleHog Secret Scanning
+        uses: trufflesecurity/trufflehog@v3.82.13
+        with:
+          # Scan the entire repository for secrets
+          path: ./
+          base: ${{ github.event.repository.default_branch }}
+          head: HEAD
+          # Scan for both verified and unverified secrets
+          # Focus on detecting: Access Keys, Secret Keys, Passwords, API Tokens
+          # Note: --fail is added automatically by the action
+          extra_args: --exclude-paths=.trufflehogignore --json

.trufflehogignore

@@ -0,0 +1,3 @@
+# TruffleHog exclusion patterns
+# Exclude docker-compose files with placeholder passwords
+aws/md/docker-compose\.yml

README.md

@@ -45,3 +45,13 @@ Recommended to use with the redc tool
 Static resources required at runtime are downloaded through proxy links defined in github_proxy in the template. AWS scenarios do not need to consider proxies.
 
 Files generated after execution are stored on R2 storage, implemented through the upload_r2 module of the redc engine
+
+## Security
+
+This repository uses GitHub Actions to automatically check for sensitive information:
+
+- **Secret Scanning**: Automatically detects access keys (AK), secret keys (SK), passwords, and other sensitive information in the code
+- **CI/CD Integration**: Scanning is triggered on every push and pull request
+- **Leak Prevention**: CI fails and blocks merging when sensitive information is detected
+
+⚠️ **Important**: Do not write real AK/SK, passwords, or other sensitive information directly into the code. Use environment variables or configuration files to manage sensitive information.

README_CN.md

@@ -45,3 +45,13 @@ vultr (不推荐使用)
 运行时所需的静态资源通过模板中 github_proxy 的定义的代理链接去下载，aws 场景无需考虑代理
 
 运行后的文件存储在 R2 存储上,通过 redc 引擎的 upload_r2 模块实现上传功能
+
+## 安全检查
+
+本仓库使用 GitHub Actions 自动检查敏感信息：
+
+- **敏感信息扫描**: 自动检测代码中的访问密钥(AK)、秘密密钥(SK)、密码等敏感信息
+- **CI/CD 集成**: 每次推送和 Pull Request 都会触发自动扫描
+- **防止泄露**: 检测到敏感信息时，CI 会失败并阻止合并
+
+⚠️ **重要**: 请勿将真实的 AK/SK、密码等敏感信息直接写入代码中。应使用环境变量或配置文件管理敏感信息。