Release 2026-09-03e: GitHub Actions bumped to v7 (Dependabot) #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: [ main, master, develop ] | |
| pull_request: | |
| branches: [ main, master, develop ] | |
| jobs: | |
| secret-scan: | |
| name: Detect Secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 # Full history for comprehensive scanning | |
| - name: Set up Python | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.11' | |
| - name: Install detect-secrets | |
| run: | | |
| pip install detect-secrets | |
| - name: Run detect-secrets scan | |
| run: | | |
| detect-secrets scan \ | |
| --exclude-files 'configs/.*\.json' \ | |
| --exclude-files '\.md$' \ | |
| --exclude-files 'package-lock\.json' \ | |
| --exclude-files '\.lock$' \ | |
| --exclude-files '\.baseline$' \ | |
| --baseline .secrets.baseline | |
| - name: Check for secrets in git history (last 100 commits) | |
| run: | | |
| # detect-secrets 1.5 has no stdin mode, so the recent history is written to a | |
| # file first. Baseline files, lock files and markdown are left out of the diff; | |
| # a finding whose hash is already in .secrets.baseline is a known placeholder. | |
| git log --all --pretty=format: -p -100 -- . ':!*.baseline' ':!*.lock' ':!*.md' > history.diff | |
| detect-secrets scan --exclude-files 'configs/.*\.json' history.diff > history-scan.json | |
| python - history-scan.json <<'PY' | |
| import json, sys | |
| known = {f.get("hashed_secret") | |
| for fs in json.load(open(".secrets.baseline")).get("results", {}).values() | |
| for f in fs} | |
| results = json.load(open(sys.argv[1])).get("results", {}) | |
| new = [(p, f.get("line_number"), f.get("type")) | |
| for p, fs in results.items() for f in fs | |
| if f.get("hashed_secret") not in known] | |
| for path, line, kind in new: | |
| print(f"{path}:{line} {kind}") | |
| if new: | |
| sys.exit("Secrets detected in git history that are not in the baseline") | |
| print("No new secrets detected in git history") | |
| PY | |
| - name: Security scan summary | |
| if: always() | |
| run: | | |
| echo "✅ Secret scanning complete" | |
| echo "If secrets were detected, the job will fail above" | |
| echo "To update baseline: detect-secrets scan --baseline .secrets.baseline" | |
| prompt-injection-check: | |
| name: Prompt Injection Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Set up Python | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.11' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Install dependencies | |
| run: uv sync | |
| - name: Run prompt injection detection | |
| run: | | |
| echo "🔍 Scanning for prompt injection patterns..." | |
| echo "Includes detection for Unicode steganography attacks from Repello.ai article" | |
| echo "" | |
| # Create baseline if it doesn't exist, then check against it | |
| if [ ! -f .prompt_injections.baseline ]; then | |
| echo "📋 Creating baseline for first time..." | |
| uv run python .security/check_prompt_injections.py --update-baseline src/ tests/ *.md *.yml *.yaml *.json *.py | |
| else | |
| echo "📋 Using existing baseline..." | |
| uv run python .security/check_prompt_injections.py --baseline src/ tests/ *.yml *.yaml *.json *.py | |
| fi |