Archived
beatzaplentyandClaude Sonnet 4.6
b269a5d616
- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns - .github/workflows/secret-scan.yml — GitHub Actions (full history scan) - .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow) - scripts/check-secrets.sh — shared runner used by both CI and local; supports --staged-only for pre-commit hook use; falls back to Docker if gitleaks isn't on PATH - scripts/install-hooks.sh — installs pre-commit hook pointing at above - pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash in pihole.toml in-place before the file is committed - pihole/pull-config.sh — updated to call sanitize-config.sh automatically after every pull so the repo stays clean by default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
29 lines
716 B
YAML
29 lines
716 B
YAML
name: Secret Scan
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
branches: ["**"]
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: Scan for secrets and sensitive config
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # full history for gitleaks git-log scan
|
|
|
|
- name: Install gitleaks
|
|
run: |
|
|
GITLEAKS_VERSION="8.21.2"
|
|
curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
|
|
| tar -xz -C /usr/local/bin gitleaks
|
|
gitleaks version
|
|
|
|
- name: Run secret scan
|
|
run: bash scripts/check-secrets.sh
|