chore: use gitleaks for secret scanning

[lvrach]

Description

Makefile

Add sec on target on Makefile:

• scan secrets using gitleaks, doing a full git history scan
• run go vuln checks

sec also runs as part of make lint

.gitleaksignore is used to skip already-known secrets

Github action

Using official gitleaks-action, some notes:

• GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}. This is required since we are an org. The GITLEAKS_LICENSE is configured on the org level.
• GITLEAKS_NOTIFY_USER_LIST is setup to notify @rudderlabs/security-alerts alias.

The workflow is configured to be triggered in multiple ways:

on:
  pull_request:  # commenting on the thread
  push: # when we push to a branch, but we don't have a PR yet
  workflow_dispatch: # allow to run manually
  schedule:
    - cron: "0 13 * * *" # run once a day at 13:00 UTC, helping discover secrets from new detection mechanisms 

Linear Ticket

https://linear.app/rudderstack/issue/PRI-36/use-gitleaks-for-secret-scanning

Refs PRI-36

Security

• The code changed/added as part of this pull request won't create any security issues with how the software is being used.

[github-actions]

🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit c7b2e4a.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo c7b2e4ae3cde679f36228101162a8a63ac91e576:test_git_leaks_ci.txt:generic-api-key:1 >> .gitleaksignore

[github-actions]

🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit c7b2e4a.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo c7b2e4ae3cde679f36228101162a8a63ac91e576:test_git_leaks_ci.txt:generic-api-key:1 >> .gitleaksignore

cc @lvrach,@SumanthPuram,@psrikanth88

[github-actions]

🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit c7b2e4a.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo c7b2e4ae3cde679f36228101162a8a63ac91e576:test_git_leaks_ci.txt:generic-api-key:1 >> .gitleaksignore

cc @rudderlabs/security-alerts

[fracasula]

I merged a PR a while back to remove these. Are you sure some of these lines are still relevant? Last time I removed all the RSA keys. Of course it will still complain about the certificates though.

[lvrach]

It is still part of git history, running secret scanning on the latest didn't detect anything. The work to remove RSA keys is still important to avoid false positives moving forward.