Add secret scanning for commits and Forgejo Actions #13

New issue

Closed

opened 2026-08-29 00:22:51 -05:00 by portegumi · 1 comment

portegumi commented

2026-08-29 00:22:51 -05:00

Collaborator

Description

Add automated secret detection suitable for a public repository. Local checks and Forgejo Actions should catch common credentials and private material before or immediately after they enter repository history.

Scope

Select Gitleaks or an equivalent tool compatible with Forgejo Actions.
Add a repository configuration only where project-specific exclusions are necessary.
Scan current tracked content and future changes.
Document local invocation, CI behavior, false-positive handling, and credential-rotation response.
Keep workflows Forgejo-native rather than adding GitHub-specific assumptions.

Acceptance criteria

The complete repository history and working tree pass an initial secret scan.
Forgejo Actions runs secret scanning for relevant pushes and pull requests.
A safe synthetic test confirms the scanner fails on representative secret material without committing a real credential.
Suppressions are narrow, reviewed, and documented.
Response steps explain that exposed credentials must be revoked or rotated, not merely deleted from the latest commit.

Dependencies / blockers

Requires an available Linux Forgejo runner. This control should be established before secret-bearing deployment integrations are added.

## Description Add automated secret detection suitable for a public repository. Local checks and Forgejo Actions should catch common credentials and private material before or immediately after they enter repository history. ## Scope - Select Gitleaks or an equivalent tool compatible with Forgejo Actions. - Add a repository configuration only where project-specific exclusions are necessary. - Scan current tracked content and future changes. - Document local invocation, CI behavior, false-positive handling, and credential-rotation response. - Keep workflows Forgejo-native rather than adding GitHub-specific assumptions. ## Acceptance criteria - [ ] The complete repository history and working tree pass an initial secret scan. - [ ] Forgejo Actions runs secret scanning for relevant pushes and pull requests. - [ ] A safe synthetic test confirms the scanner fails on representative secret material without committing a real credential. - [ ] Suppressions are narrow, reviewed, and documented. - [ ] Response steps explain that exposed credentials must be revoked or rotated, not merely deleted from the latest commit. ## Dependencies / blockers Requires an available Linux Forgejo runner. This control should be established before secret-bearing deployment integrations are added.

portegumi added the

security

ci-cd

labels

2026-08-29 00:22:51 -05:00