ci: add secret-scan (gitleaks) — compliance hardening - #4
Merged
Conversation
…tives Redacts hardcoded secrets from the current tree (replaced with a placeholder; NOT rotated), allowlists confirmed false positives in .gitleaks.toml (docs, tests, templates, SealedSecrets, SCAP content, public client config), and inventories remaining historical occurrences in .gitleaksignore (pending rotation + history purge). No history rewrite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tives Redacts hardcoded secrets from the current tree (replaced with a placeholder; NOT rotated), allowlists confirmed false positives in .gitleaks.toml (docs, tests, templates, SealedSecrets, SCAP content, public client config), and inventories remaining historical occurrences in .gitleaksignore (pending rotation + history purge). No history rewrite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a secret-scan CI (gitleaks binary,
--redact) that flags committed secrets on PRs, weekly, and on demand — no secret value is ever printed.This is the plan-independent fix for the compliance audit finding SCM-SECRETSCAN-001: it gives this repo secret detection for free, without GitHub Advanced Security (a paid add-on on private repos). The gitleaks binary is used deliberately — the gitleaks Action requires a paid license for orgs; the binary does not.
If the check fails on first run, a real secret is committed — rotate it and purge it from history.
Part of the estate-wide hardening pass (see the hardening report).
🤖 Generated with Claude Code