Add secret scanning for commits and Forgejo Actions

gitchegumi commented

2026-09-02 16:44:50 -05:00

Owner

Description

Add automated secret detection suitable for a public repository. Local checks and Forgejo Actions should catch common credentials and private material before or immediately after they enter repository history.

Scope

Select Gitleaks or an equivalent tool compatible with Forgejo Actions.
Add a repository configuration only where project-specific exclusions are necessary.
Scan current tracked content and future changes.
Document local invocation, CI behavior, false-positive handling, and credential-rotation response.
Keep workflows Forgejo-native rather than adding GitHub-specific assumptions.

Acceptance criteria

The complete repository history and working tree pass an initial secret scan.
Forgejo Actions runs secret scanning for relevant pushes and pull requests.
A safe synthetic test confirms the scanner fails on representative secret material without committing a real credential.
Suppressions are narrow, reviewed, and documented.
Response steps explain that exposed credentials must be revoked or rotated, not merely deleted from the latest commit.

Dependencies / blockers

Requires an available Linux Forgejo runner. This control should be established before secret-bearing deployment integrations are added.

## Description Add automated secret detection suitable for a public repository. Local checks and Forgejo Actions should catch common credentials and private material before or immediately after they enter repository history. ## Scope - Select Gitleaks or an equivalent tool compatible with Forgejo Actions. - Add a repository configuration only where project-specific exclusions are necessary. - Scan current tracked content and future changes. - Document local invocation, CI behavior, false-positive handling, and credential-rotation response. - Keep workflows Forgejo-native rather than adding GitHub-specific assumptions. ## Acceptance criteria - [x] The complete repository history and working tree pass an initial secret scan. - [x] Forgejo Actions runs secret scanning for relevant pushes and pull requests. - [x] A safe synthetic test confirms the scanner fails on representative secret material without committing a real credential. - [x] Suppressions are narrow, reviewed, and documented. - [x] Response steps explain that exposed credentials must be revoked or rotated, not merely deleted from the latest commit. ## Dependencies / blockers Requires an available Linux Forgejo runner. This control should be established before secret-bearing deployment integrations are added.

gitchegumi added this to the Homelab Roadmap project

2026-09-02 16:45:25 -05:00

gitchegumi added the

security

ci-cd

labels

2026-09-02 16:45:44 -05:00

kiyi referenced this issue

2026-09-03 21:26:36 -05:00

Establish versioned workflows reusable across organizations #3

kiyi referenced this issue

2026-09-03 21:30:21 -05:00

Implement the standard security scan baseline #4

kiyi referenced this issue

2026-09-03 21:31:00 -05:00

Implement build-once artifact publishing and controlled promotion #5

kiyi referenced this issue

2026-09-03 21:40:01 -05:00

feat(ci): scaffold reusable security and delivery workflows #6

kiyi commented

2026-09-03 21:40:24 -05:00

Member

Initial implementation is in PR #6: a callable Gitleaks workflow scans full fetched Git history and the working tree, redacts findings, and fails on findings, scanner errors or an unexpected tool version. Local invocation and rotation/exception guidance are included.

YAML/Bash validation and mocked gate-control tests passed. Real Gitleaks history/working-tree scans and synthetic detection on the selected runner are still required, so this issue remains open. Runner activation and cross-repository access are tracked in #3; broader scanning in #4.

Initial implementation is in PR #6: a callable Gitleaks workflow scans full fetched Git history and the working tree, redacts findings, and fails on findings, scanner errors or an unexpected tool version. Local invocation and rotation/exception guidance are included. YAML/Bash validation and mocked gate-control tests passed. Real Gitleaks history/working-tree scans and synthetic detection on the selected runner are still required, so this issue remains open. Runner activation and cross-repository access are tracked in #3; broader scanning in #4.

kiyi referenced this issue

2026-09-03 22:38:25 -05:00

feat(security): add reusable fail-closed scans and mitigations #7

kiyi referenced this issue

2026-09-04 16:35:31 -05:00

fix(ci): add trusted repository self-scan #12

kiyi commented

2026-09-04 16:35:50 -05:00

Member

Progress update: PR #12 adds the workflows repository's trusted self-scan caller. It targets pull requests, pushes to main, manual runs, and a weekly schedule while pinning the evaluated implementation to v1.1.0. The PR run has expanded into the released reusable workflow and is queued on the ci runner.

The Gitleaks gate, narrow mitigation format, and exposed-credential rotation procedure are implemented and documented. I am leaving the initial repository pass and safe synthetic live failure unchecked until Forgejo supplies direct run evidence; the issue remains open.

Progress update: PR #12 adds the workflows repository's trusted self-scan caller. It targets pull requests, pushes to main, manual runs, and a weekly schedule while pinning the evaluated implementation to v1.1.0. The PR run has expanded into the released reusable workflow and is queued on the ci runner. The Gitleaks gate, narrow mitigation format, and exposed-credential rotation procedure are implemented and documented. I am leaving the initial repository pass and safe synthetic live failure unchecked until Forgejo supplies direct run evidence; the issue remains open.

kiyi commented

2026-09-04 16:46:54 -05:00

Member

Initial repository acceptance is now complete. PR #12 run 36 scanned the complete fetched history and working tree with the released v1.1.0 gate. The first run surfaced five Semgrep network audit warnings; each was reviewed and constrained by an exact expiring mitigation, and the corrected run passed with 0 unmitigated findings and 0 scanner errors.

The push criterion remains unchecked until the workflow is merged and the main-branch run succeeds. The safe synthetic failure criterion also remains open for a dedicated live negative run.

Initial repository acceptance is now complete. PR #12 run 36 scanned the complete fetched history and working tree with the released v1.1.0 gate. The first run surfaced five Semgrep network audit warnings; each was reviewed and constrained by an exact expiring mitigation, and the corrected run passed with 0 unmitigated findings and 0 scanner errors. The push criterion remains unchecked until the workflow is merged and the main-branch run succeeds. The safe synthetic failure criterion also remains open for a dedicated live negative run.

kiyi referenced this issue

2026-09-04 23:45:46 -05:00

Implement the standard security scan baseline #4

kiyi commented

2026-09-04 23:46:11 -05:00

Member

Checked the push/pull-request execution criterion: the trusted self-scan is merged and now uses v1.2.1 through #16. PR scan 59 and main push scan 61 both succeeded. The owner also confirmed required scanner status checks are configured on main.

This issue is now 4/5. The remaining task is the dedicated safe synthetic-secret negative run on the live Forgejo runner, with evidence that detection fails the gate without committing a real credential. Earlier local fixtures do not replace that live acceptance test.

Checked the push/pull-request execution criterion: the trusted self-scan is merged and now uses v1.2.1 through #16. [PR scan 59](https://git.gitchegumi.com/Homelab/workflows/actions/runs/59) and [main push scan 61](https://git.gitchegumi.com/Homelab/workflows/actions/runs/61) both succeeded. The owner also confirmed required scanner status checks are configured on main. This issue is now 4/5. The remaining task is the dedicated safe synthetic-secret negative run on the live Forgejo runner, with evidence that detection fails the gate without committing a real credential. Earlier local fixtures do not replace that live acceptance test.

kiyi referenced this issue

2026-09-05 00:22:42 -05:00

test(ci): exercise released gates on live pull requests #17

kiyi commented

2026-09-05 00:24:55 -05:00

Member

The final acceptance criterion is now verified live. Run 63 from #17 executed the exact secret-scan step from the pinned v1.2.1 release using Gitleaks 8.30.1. It accepted clean history/tree, returned failure for a runtime-generated nonfunctional credential-shaped value in the working tree, and still returned failure after that synthetic value was committed and then deleted in a disposable local Git history. The tree was confirmed clean in the history-only case. Console output and JSON reports were checked for redaction.

Missing Gitleaks and an unexpected version also failed closed. All 12 acceptance cases passed and a sanitized summary artifact was retained. No real credential was committed or used; fixtures were temporary inside the runner job. Checklist: 5/5. #17 preserves the reusable acceptance suite for review and merge.

The final acceptance criterion is now verified live. [Run 63](https://git.gitchegumi.com/Homelab/workflows/actions/runs/63/jobs/0) from #17 executed the exact secret-scan step from the pinned v1.2.1 release using Gitleaks 8.30.1. It accepted clean history/tree, returned failure for a runtime-generated nonfunctional credential-shaped value in the working tree, and still returned failure after that synthetic value was committed and then deleted in a disposable local Git history. The tree was confirmed clean in the history-only case. Console output and JSON reports were checked for redaction. Missing Gitleaks and an unexpected version also failed closed. All 12 acceptance cases passed and a sanitized summary artifact was retained. No real credential was committed or used; fixtures were temporary inside the runner job. Checklist: 5/5. #17 preserves the reusable acceptance suite for review and merge.

kiyi referenced this issue

2026-09-05 00:28:16 -05:00

test(ci): exercise released gates on live pull requests #17

gitchegumi commented

2026-09-05 00:28:55 -05:00

Author

Owner

Closing as complete

gitchegumi closed this issue

2026-09-05 00:28:55 -05:00

~~kiyi referenced this issue 2026-10-12 00:00:08 -05:00~~

Build matching signed Python payloads for ComfyUI candidates #90