fix(feedback): adapt to the LIVE table instead of migrating it, and c… #1348
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔒 AAA Secrets Audit (WAJIB) | |
| on: | |
| push: | |
| branches: [main, develop, '**'] | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| merge_group: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| secrets-audit: | |
| if: github.actor != 'dependabot[bot]' && github.actor != 'app/dependabot' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Python | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.12' | |
| - name: Install detect-secrets | |
| run: pip install detect-secrets | |
| - name: Pull latest baseline | |
| run: | | |
| git checkout HEAD -- .secrets.baseline 2>/dev/null || \ | |
| echo "[]" > .secrets.baseline | |
| - name: Run secrets scan (exclude _archive, memory, secrets/) | |
| id: scan | |
| run: | | |
| set -euo pipefail | |
| echo "=== Scanning for new secrets (excluding _archive/, memory/, secrets/, runtime artifacts, skills/_meta.json) ===" | |
| # Logic lives in scripts/ci/secrets_scan_new_findings.py (it is long, and | |
| # it is easier to read, test and lint as a real file than as Python | |
| # embedded in YAML embedded in a shell command substitution). | |
| # | |
| # `|| RC=$?` is DELIBERATE. Under `set -e`, a bare assignment from a | |
| # failing command substitution aborts the step BEFORE any diagnostics | |
| # print. That is exactly how this gate previously failed blind: CI | |
| # reported only "##[error]Process completed with exit code 1." with an | |
| # empty log, hiding both the cause and the offending finding. | |
| RC=0 | |
| SCAN_LOG="$(mktemp)" | |
| python3 scripts/ci/secrets_scan_new_findings.py >"$SCAN_LOG" 2>&1 || RC=$? | |
| cat "$SCAN_LOG" | |
| echo | |
| grep -E '^NEW_SECRETS_FOUND=' "$SCAN_LOG" >>"$GITHUB_OUTPUT" || true | |
| if [ "$RC" -ne 0 ]; then | |
| { | |
| echo "::error::secrets-audit FAILED (exit ${RC}). Full diagnostics are above." | |
| echo "A reviewed FALSE POSITIVE (e.g. a secret *reference* such as" | |
| echo '"api_key_ref": "secrets::SOME_VAR") is cleared by refreshing the' | |
| echo "baseline in a separate, reviewable commit — never to silence a real key:" | |
| echo " detect-secrets scan . --exclude-files ... > .secrets.baseline" | |
| } | |
| exit "$RC" | |
| fi | |
| echo "✅ secrets-audit passed — no new secrets relative to .secrets.baseline" | |
| - name: Pattern scan (fast regex check) | |
| if: always() | |
| run: | | |
| set -euo pipefail | |
| echo "=== Pattern scan: Telegram tokens, API keys, GitHub tokens ===" | |
| FOUND=0 | |
| # Check git-visible changed files only. Ignore runtime artifacts and ignored files. | |
| for f in $(git ls-files --cached --others --exclude-standard); do | |
| [[ "$f" =~ ^(_archive|archive|docs|memory|reports|secrets|wiki|\.git)/ ]] && continue | |
| [[ "$f" =~ ^agents/.*/runtime/ ]] && continue | |
| [[ "$f" =~ ^canon/PETRONAS/qdrant_backup_.*\.json$ ]] && continue | |
| [[ -d "$f" ]] && continue | |
| [[ ! -f "$f" ]] && continue | |
| if grep -rqE '(bot\d+:[A-Za-z0-9_\-]{20,}|gh[pousr]_[A-Za-z0-9_]{35,}|sk-[A-Za-z0-9_\-]{30,}|AKIA[A-Z0-9]{16})' "$f" 2>/dev/null; then | |
| MATCH=$(grep -rE '(bot\d+:[A-Za-z0-9_\-]{20,}|gh[pousr]_[A-Za-z0-9_]{35,}|sk-[A-Za-z0-9_\-]{30,}|AKIA[A-Z0-9]{16})' "$f" 2>/dev/null | head -3) | |
| echo " 🚫 Secret pattern in $f:" | |
| echo "$MATCH" | sed 's/^/ /' | |
| FOUND=1 | |
| fi | |
| done | |
| if [ "$FOUND" = "1" ]; then | |
| echo "PATTERN_FOUND=true" | |
| echo "❌ Known secret patterns detected" | |
| exit 1 | |
| else | |
| echo "✅ No known secret patterns detected" | |
| echo "PATTERN_FOUND=false" | |
| fi | |
| block-secrets: | |
| if: (needs.secrets-audit.result == 'failure' && (github.event_name == 'push' | |
| || github.event_name == 'pull_request')) && (github.actor != | |
| 'dependabot[bot]' && github.actor != 'app/dependabot') | |
| needs: [secrets-audit] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 🚫 BLOCK — Secrets detected | |
| run: | | |
| echo "============================================" | |
| echo "🛑 SECRETS BLOCK — COMMIT REJECTED" | |
| echo "============================================" | |
| echo "" | |
| echo "The secrets-audit job FAILED — secrets or patterns were detected." | |
| echo "" | |
| echo "FIX: Remove secrets from your changes, then push again." | |
| echo "" | |
| echo "To whitelist a false positive (AFTER removing the secret):" | |
| echo " 1. Remove the secret from the file" | |
| echo " 2. Run: detect-secrets scan . > .secrets.baseline" | |
| echo " 3. git add .secrets.baseline && git commit --amend --no-edit" | |
| echo " 4. git push --force-with-lease" | |
| echo "" | |
| echo "To suppress a known pattern (NOT recommended):" | |
| echo " Add '# pragma: allowlist secret' above the line in the source file" | |
| echo "" | |
| echo "This is a WAJIB gate — F1 AMANAH enforcement." | |
| echo "No secrets may pass this layer." | |
| exit 1 |