credentials-scan.yml

name: Credentials Scan

# read-only repo token
# no access to secrets
on:
  pull_request:
    branches: [master, test, dev]
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  credentials-scan:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      - name: Setup python
        uses: actions/setup-python@v2
        with:
          python-version: "3.x"

      - name: Display python version
        run: python -c "import sys; print(sys.version)"

      - name: Cache python dependencies
        uses: actions/cache@v2
        with:
          path: ~/.cache/pip # This path is specific to Ubuntu
          key: ${{ runner.os }}-pip

      - name: Install requirements
        run: python3 -m pip install trufflehog3 jtbl

      - name: Scan with trufflehog3
        id: scan
        run: trufflehog3 --no-history --config .github/.trufflehog3.yml --format json --output trufflehog_report.json

      # need to save these as artifacts so the comment-pr workflow can pick it up because
      # this action has no write access to pull requests (even adding comments)
      - name: Save PR number and scan results
        if: always()
        run: |
          mkdir -p ./pr
          echo ${{ github.event.pull_request.number }} > ./pr/NR
          ./tools/cicd/build/secops_report.sh trufflehog_report.json > ./pr/PRBODY

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: pr
          path: pr/

      - name: Human readable scan report
        if: always()
        run: ./tools/cicd/build/secops_report.sh trufflehog_report.json

      - name: Generate HTML report only if secrets were found
        if: failure()
        run: trufflehog3 -R trufflehog_report.json --output trufflehog_report.html

      - name: Upload HTML report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: Security Scan Report
          path: trufflehog_report.html
          retention-days: 7