OSAC-2465: Add gitleaks pre-commit hook, remove per-PR workflow - #140
Conversation
|
@minmzzhang: This pull request references OSAC-2465 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: osac-project/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (7)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (6)
WalkthroughThe pull request adds local Gitleaks checks and moves pull-request diff scanning into the pre-commit workflow. CI uses base-branch rules and posts rotation guidance for findings. Documentation and allowlist guidance are updated. ChangesGitleaks secret scanning
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant BaseRevision
participant GitleaksContainer
participant GitHubPRComment
PullRequest->>GitHubActions: Trigger pre-commit workflow
GitHubActions->>BaseRevision: Load Gitleaks configuration and ignore rules
GitHubActions->>GitleaksContainer: Scan the base-to-head diff
GitleaksContainer-->>GitHubActions: Return scan result
GitHubActions->>GitHubPRComment: Create or update rotation reminder
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
5bee6ee to
54f30de
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pre-commit.yaml:
- Around line 9-18: Move issues: write out of the scan job’s permissions,
leaving that job with only contents: read. Isolate the comment step in a
separate job that receives issues: write and does not check out or execute pull
request-controlled content; preserve the existing scan and commenting behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: cf46f07d-819f-4c21-ab42-fa7037b61a85
📒 Files selected for processing (7)
.github/workflows/pre-commit.yaml.github/workflows/secret-scanning.yaml.gitleaks.toml.pre-commit-config.yamlbare-metal-fulfillment-operator/AGENTS.mdosac-aap/AGENTS.mdosac-installer/AGENTS.md
💤 Files with no reviewable changes (1)
- .github/workflows/secret-scanning.yaml
Catch secrets at commit time and fold the CI scan into pre-commit.yaml so fork PRs no longer trigger a separate secret-scanning workflow. CI loads .gitleaks.toml/.gitleaksignore from the base branch and runs even when lint fails so a broken check cannot mask a leak. Harden further: drop gitleaks --verbose (secrets can leak before redaction), and isolate issues: write in a comment-only job that does not check out PR content. Signed-off-by: Min Zhang <minzhang@redhat.com> Assisted-by: Cursor <cursoragent@cursor.com>
54f30de to
727fcdc
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: minmzzhang, omer-vishlitzky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Summary
gitleakspre-commit hook to catch secrets at commit time before they reach the repositorysecret-scanning.yamlCI workflow; fold its gitleaks scan intopre-commit.yamlto reduce attack surface on fork PRspre-commit.yaml: explicit least-privilege permissions, SHA-pinned actions,persist-credentials: false,if: always()so lint failures cannot mask a secret leak.gitleaks.tomland.gitleaksignorefrom the base branch (not the PR checkout) and passes--ignore-gitleaks-allowso PR authors cannot weaken the scan.gitleaks.tomlfrom deprecated[allowlist]to[[allowlists]](gitleaks ≥ v8.25)Port of osac-installer#451 into the monorepo.
How to suppress a false positive
# gitleaks:allowas an inline comment on the flagged line (pre-commit only).--ignore-gitleaks-allow). Add a narrowly-scoped[[allowlists]]entry to.gitleaks.tomland merge it to the base branch first.Never allowlist a real secret — rotate it at its source immediately instead.
Test plan
pre-commit install && pre-commit run gitleakson staged files locallysecret-scanning.yamlno longer runs on PRsSummary by CodeRabbit
New Features
Documentation
Bug Fixes