ci: add secret-scan gate to block hardcoded credentials (refs #151) - #3
Merged
Conversation
This template is cloned verbatim into every user's service repo, so any committed provider secret ships to every customer and trips GitHub push protection on their deploy (apsoai/apso-platform-server#151, first seen in the v1 TypeScript template's hardcoded Stripe key). - scripts/secret-scan.sh: scans tracked files for high-confidence provider secret patterns (Stripe sk_/rk_, AWS AKIA, GitHub gh*_, Slack xox*, PEM private keys). Publishable pk_ keys and local-dev defaults are intentionally not flagged. Portable to bash 3.2 and 4+. - .github/workflows/secret-scan.yml: runs the scan on push and pull_request. This repo had no CI; this is a standalone gate. Scan is clean on the current template. Parallel to apsoai/service-template-ts#20. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs apsoai/apso-platform-server#151. Parallel to apsoai/service-template-ts#20 (the TypeScript template's gate).
Why
Issue #151: a hardcoded Stripe test secret shipped in a scaffolded template, blocking user deploys via GitHub push protection and leaking the key into every generated repo. This template is cloned verbatim into users' services, so any committed secret reaches every customer.
Scan result for this repo
This template is clean of provider secrets. The only credential-shaped literals are local-dev defaults (docker-compose / localhost postgres passwords), which are not provider secrets and are intentionally out of the gate's scope. No source change was needed — this PR is the preventive gate only.
What
scripts/secret-scan.sh: scans tracked files for high-confidence provider secret patterns — Stripesk_/rk_, AWSAKIA, GitHubgh*_, Slackxox*, PEM private keys. Publishablepk_keys are allowed by design. Portable to bash 3.2 (macOS) and 4+ (CI)..github/workflows/secret-scan.yml: runs the scan on push and PR. This repo had no CI, so the workflow is standalone.Verified locally
secret-scan: clean, exit 0.sk_test_…: scan fails (exit 1) with a pointed error.Scope
Preventive half only — it stops recurrence in this template path. The already-exposed key (S3 starter zip, archived v1 template history, previously-scaffolded repos) needs rotation, which is flagged to Matt and out of an agent's scope.
🤖 Generated with Claude Code