Skip to content

修正密鑰外洩掃描／修正密钥泄露扫描／Fix the secret scan／シークレットスキャンの修正 #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hitoshic1982 merged 2 commits into from
Oct 8, 2026
Merged

修正密鑰外洩掃描／修正密钥泄露扫描／Fix the secret scan／シークレットスキャンの修正 #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9fb9625
ci: run the pinned open-source Gitleaks CLI instead of the licensed a…
hitoshic1982 Oct 8, 2026
8ccfe2e
ci: audit the pinned Gitleaks CLI and pin appimagetool to the tagged …
hitoshic1982 Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions .github/workflows/secret-defense.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,12 @@ jobs:
with:
fetch-depth: 0

- name: Install gitleaks OSS CLI
run: |
curl -fsSL -o gitleaks.tar.gz \
https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb gitleaks.tar.gz" | sha256sum -c -
tar -xzf gitleaks.tar.gz gitleaks
chmod +x gitleaks
- name: Scan repository history for secrets
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: ./gitleaks detect --source . --redact --verbose
Comment thread
hitoshic1982 marked this conversation as resolved.
10 changes: 5 additions & 5 deletions packaging/linux/build-appimage.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,11 +57,11 @@ exec "${here}/usr/bin/FB2Blogger.Desktop" "$@"
APPRUN
chmod +x "${app_dir}/AppRun" "${app_dir}/usr/bin/FB2Blogger.Desktop"

# AppImage upstream intentionally uses continuous releases. The content digest
# pins this download to commit 8c8c91f762b412a19f4e8d2c4b35afb98f2d7c81
# (published 2025-12-04); an upstream replacement fails closed until reviewed.
appimagetool_url="https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage"
appimagetool_sha256="a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0"
# The "continuous" upstream asset is replaced in place, which broke its pinned
# digest. Pin the tagged 1.9.1 release asset and its content digest instead;
# any upstream replacement still fails closed until reviewed.
appimagetool_url="https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage"
appimagetool_sha256="ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0"
appimagetool="${work_dir}/appimagetool-x86_64.AppImage"
curl --fail --location --proto '=https' --tlsv1.2 "${appimagetool_url}" -o "${appimagetool}"
printf '%s %s\n' "${appimagetool_sha256}" "${appimagetool}" | sha256sum --check --strict
Expand Down
6 changes: 4 additions & 2 deletions tests/AuditHarness/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,8 +118,10 @@

var secretDefenseWorkflow = File.ReadAllText(Path.Combine(workflowDirectory, "secret-defense.yml"));
Check(
Regex.IsMatch(secretDefenseWorkflow, @"gitleaks/gitleaks-action@[0-9a-f]{40}(?:\r?$|\s)", RegexOptions.Multiline, TimeSpan.FromSeconds(1)),
"Secret Defense pins Gitleaks to an immutable commit");
Regex.IsMatch(secretDefenseWorkflow, @"github\.com/gitleaks/gitleaks/releases/download/v\d+\.\d+\.\d+/gitleaks_\d+\.\d+\.\d+_linux_x64\.tar\.gz", RegexOptions.None, TimeSpan.FromSeconds(1)) &&
Regex.IsMatch(secretDefenseWorkflow, @"echo ""[0-9a-f]{64} gitleaks\.tar\.gz"" \| sha256sum -c -", RegexOptions.None, TimeSpan.FromSeconds(1)) &&
!secretDefenseWorkflow.Contains("gitleaks/gitleaks-action", StringComparison.Ordinal),
"Secret Defense runs a version-pinned, checksum-verified open-source Gitleaks CLI");

var securityAuditWorkflow = File.ReadAllText(Path.Combine(workflowDirectory, "security-audit.yml"));
Check(
Expand Down
6 changes: 3 additions & 3 deletions tests/PackagingAudit/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,9 +64,9 @@ void Check(bool condition, string name)
linuxScript.Contains("Permission is hereby granted", StringComparison.Ordinal) &&
linuxScript.Contains("sha256sum", StringComparison.Ordinal),
"Linux packaging creates, extracts, launches, and hashes a real AppImage containing the MIT license");
Check(linuxScript.Contains("8c8c91f762b412a19f4e8d2c4b35afb98f2d7c81", StringComparison.Ordinal) &&
linuxScript.Contains("a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0", StringComparison.Ordinal),
"AppImage tooling is fail-closed to an audited upstream commit and SHA256");
Check(linuxScript.Contains("appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage", StringComparison.Ordinal) &&
linuxScript.Contains("ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0", StringComparison.Ordinal),
"AppImage tooling is fail-closed to the tagged 1.9.1 release and its SHA256");

Check(metadataScript.Contains("REF_TYPE", StringComparison.Ordinal) &&
metadataScript.Contains("PR-${PR_NUMBER", StringComparison.Ordinal) &&
Expand Down
Loading