SK-3018-gitleaks-detection-fix-added-automated-script-to-fix-generate… - #346
Conversation
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved critical and moderate issues affect secret detection, failure handling, and staging safety.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (3)
What changed in this PR
Adds automated gitleaks redaction and verification for generated code, integrating it into pre-commit workflows.
Changes:
- Adds redaction and TypeScript verification.
- Registers npm scripts for redaction and hook setup.
- Adds two-tier pre-commit secret scanning.
| File | Summary | Findings |
|---|---|---|
scripts/patch-generated-secrets.js |
Detects, redacts, compiles, and verifies generated code. | Line 248 — Moderate (3 votes): Final-scan failures can leave overwritten files un restored and stage unverified edits. |
package.json |
Registers redaction and hook setup scripts. | None recorded. |
.githooks/pre-commit |
Runs redaction and staged gitleaks scanning. | Line 48 — Critical (1 vote): Missing gitleaks allows commits containing secrets, and CI does not block findings. Line 46 — Moderate (2 votes): Unconditionally stages all working-tree changes, including unrelated or incomplete changes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
Summary
Fern regenerates
src/_generated_from scratch, so realistic-looking example secrets in its JSDoc comments (a fake JWT, fake token UUIDs) keep re-triggering gitleaks on every regen. Hand-fixing them doesn't stick.This PR adds automated detection, redaction, and enforcement so this stops being a recurring manual chore.
What's included
scripts/patch-generated-secrets.js— runs the realgitleaksbinary againstRule/gitleaks.tomland auto-redacts whatever it flags insidesrc/_generated_, rather than hand-maintaining a list of known-badstrings. Redacts by position (not by the matched text itself) so it can't corrupt surrounding quotes, self-tests the local
gitleaksbuild before trusting it, verifies withtsc --noEmit, and rolls back cleanly onany failure.
.githooks/pre-commit— two-tier local guard: tier 1 runs the script above and stages only what it actually redacted (plus whatever you'd already staged); tier 2 runsgitleaks protect --stagedand blocks thecommit on anything left over.
.github/workflows/gitleaks-auto-redact.yml(new) — runs the same auto-redaction on every PR push and commits the fix straight back to the branch. Closes the gap for contributors withoutgitleaks/nodeinstalled locally.
.github/workflows/Gitleaks.yml— now actually fails the check when it finds something, instead of only commenting on the PR.Testing