✨ Check for secrets in workflows run on pull requests #1615
Conversation
laurentsimon
requested review from
azeemshaikh38,
inferno-chromium,
justaugustus and
naveensrinivasan
as code owners
|
Integration tests success for |
|
Integration tests success for |
|
Integration tests success for |
|
Integration tests success for |
| } | ||
|
|
||
| // Secrets used on jobs. | ||
| for _, job := range workflow.Jobs { |
There was a problem hiding this comment.
Do we need to check for secrets in every job here? Should we only check for secrets in the code checkout job?
There was a problem hiding this comment.
correct, the check is in checkJobForUsedSecrets()
Note: I'm going to update the code today to also verify whether an environment is declared or not, since this indicates a env secret and is typically gated by an approval, so we can discard such jobs. We can add further logic later to read the actual environment rules if we want
There was a problem hiding this comment.
updated the PR description to reflect my last comment.
laurentsimon
force-pushed
the
feat/secretspull
branch
from
d5d78e4 to
95fc4c9
Compare
|
Integration tests success for |
laurentsimon
force-pushed
the
feat/secretspull
branch
from
4d439d0 to
b59c9a6
Compare
|
Integration tests success for |
|
Integration tests success for |
|
Integration tests success for |
laurentsimon
force-pushed
the
feat/secretspull
branch
from
e7e1d65 to
4a65468
Compare
|
Integration tests success for |
|
Integration tests success for |
See point 5 in #426 (comment)
This PR looks for secrets used in job's env, jobs'
withargument, job'srunscripts and top-levelenvof the workflow.We add the following constraints
pull_requestaction/checkoutof the PR.environmentfield which typically indicates some review before running - this can be refined later thru GitHub REST API calls