fix(scheduler): audit a tick suppressed by the distributed lock (#1969) #497
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Secret scanning guard (#1164) — commit-time gitleaks on every PR. | |
| # | |
| # Catches a re-landed embedded credential (the re_-prefixed Resend key removed | |
| # in #1158 / PR #1162) BEFORE merge. Public repo => any committed secret is | |
| # world-readable and permanent, so this runs on EVERY PR — no paths filter, no | |
| # label gate (a secret can land in any file; #878 lesson). Because it always | |
| # runs, it never hits the container-security.yml "required-check absent / | |
| # Expected — waiting forever" trap, so it needs no self-skip logic. | |
| # | |
| # Uses the MIT gitleaks CLI binary, NOT gitleaks/gitleaks-action: the action | |
| # requires a paid GITLEAKS_LICENSE for org-owned repos (Abilityai is an org) and | |
| # fails on run 1. The binary is free, same coverage. Dependabot won't track the | |
| # curl'd tarball version — bumps are manual (accepted for a security tool). | |
| # | |
| # Scope = the PR/push commit range only. The burned key's base85 halves are | |
| # still in ancestor history; a full-history scan would re-flag them every run. | |
| # Range-scope excludes ancestors entirely (belt-and-suspenders: .gitleaksignore). | |
| # | |
| # --redact=100 is mandatory: a public repo's CI logs are world-readable, so the | |
| # scanner must never echo a matched secret verbatim. | |
| # | |
| # NON-BLOCKING until a repo admin adds `secret-scan` to dev/main branch | |
| # protection (a repo-settings toggle a code PR cannot perform — tracked follow-up). | |
| name: secret-scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: [dev, main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| # sha256 of gitleaks_8.30.1_linux_x64.tar.gz (from the release checksums.txt). | |
| GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 # need base+head history to scan the commit range | |
| - name: Compute scan range | |
| id: range | |
| env: | |
| GH_EVENT: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BEFORE: ${{ github.event.before }} | |
| PUSH_AFTER: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| ZERO="0000000000000000000000000000000000000000" | |
| if [ "$GH_EVENT" = "pull_request" ]; then | |
| # Guard an empty/zero base sha (mirror container-security.yml) — an | |
| # empty left side makes git read "..HEAD" and scan the wrong set. | |
| if [ -z "${PR_BASE_SHA:-}" ] || [ "$PR_BASE_SHA" = "$ZERO" ]; then | |
| RANGE="-1 ${PR_HEAD_SHA}" | |
| else | |
| # merge-base so we scan only the commits the PR adds past the fork | |
| # point — never the base branch's own advance (over-scan) or a | |
| # rewritten base (mis-scan). Fall back to base..head if merge-base | |
| # can't resolve. | |
| MB="$(git merge-base "$PR_BASE_SHA" "$PR_HEAD_SHA" 2>/dev/null || true)" | |
| if [ -n "$MB" ]; then | |
| RANGE="${MB}..${PR_HEAD_SHA}" | |
| else | |
| RANGE="${PR_BASE_SHA}..${PR_HEAD_SHA}" | |
| fi | |
| fi | |
| elif [ -n "${PUSH_BEFORE:-}" ] && [ "$PUSH_BEFORE" != "$ZERO" ]; then | |
| RANGE="${PUSH_BEFORE}..${PUSH_AFTER}" | |
| else | |
| # First push to a branch (no before sha) — scan only the tip commit, | |
| # never full history (would re-flag the historical halves). | |
| RANGE="-1 ${PUSH_AFTER}" | |
| fi | |
| echo "range=$RANGE" >> "$GITHUB_OUTPUT" | |
| echo "Scan range: $RANGE" | |
| - name: Install gitleaks (pinned binary + sha256 verify) | |
| run: | | |
| set -euo pipefail | |
| # -f: fail early on a 404 (wrong version/asset) instead of downloading | |
| # GitHub's HTML error page and surfacing later as a checksum mismatch. | |
| curl -fsSL -o gitleaks.tar.gz \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| echo "${GITLEAKS_SHA256} gitleaks.tar.gz" | sha256sum -c - | |
| tar -xzf gitleaks.tar.gz gitleaks | |
| sudo install gitleaks /usr/local/bin/gitleaks | |
| gitleaks version | |
| - name: Scan commit range for secrets | |
| env: | |
| # Pass the computed range via env (never interpolate ${{ }} into a run: | |
| # body) — matches container-security.yml, satisfies actionlint. | |
| SCAN_RANGE: ${{ steps.range.outputs.range }} | |
| run: | | |
| # GitHub Actions' default shell is `bash --noprofile --norc -eo pipefail` | |
| # — errexit (-e) is ALREADY ON. Capture gitleaks' status with `|| status=$?` | |
| # (not a bare call) or errexit aborts before our diagnosis prints. | |
| # --exit-code 2 => findings return 2; ANY OTHER non-zero is a scanner/ | |
| # config/git error (don't misdiagnose it as "secret found"). | |
| # NO --no-merges: a secret can land in a real/evil merge commit; the range | |
| # already excludes old ancestors, so excluding merges only loses coverage. | |
| set -uo pipefail | |
| status=0 | |
| gitleaks git . \ | |
| --config .gitleaks.toml \ | |
| --redact=100 \ | |
| --verbose \ | |
| --no-banner \ | |
| --exit-code 2 \ | |
| --log-opts="${SCAN_RANGE}" || status=$? | |
| if [ "$status" -eq 0 ]; then | |
| echo "OK — no secrets detected in the scanned range." | |
| elif [ "$status" -eq 2 ]; then | |
| echo "::error::Potential secret detected in this PR's changes (#1164). Findings above are REDACTED; rotate the credential and remove it from the diff. Legitimate placeholders/fixtures -> allowlist in .gitleaks.toml." | |
| exit 1 | |
| else | |
| echo "::error::gitleaks failed to run (exit $status) — config/git/runtime error, NOT a secret finding. Failing closed; inspect the step log." | |
| exit 1 | |
| fi |