Skip to content
lock

GitHub Action

Easy detect-secrets

v2.0.0 Latest version

Easy detect-secrets

lock

Easy detect-secrets

Use Yelp's detect-secrets package to scan your repository for exposed secrets

Installation

Copy and paste the following snippet into your .yml file.

 
              
- name: Easy detect-secrets

              
  uses: RobertFischer/[email protected]
Learn more about this action in RobertFischer/detect-secrets-action

Choose a version

Detect Secrets Action

This github action scans a repository usuing Yelp's Detect Secrets library.

Sample Configuration

This file is accessible at ./.github/workflows/main.yml in the action's repository.

---

# This runs Yelp's 'detect-secrets': https://github.com/Yelp/detect-secrets/blob/master/README.md

name: Scan Code for Secrets

on:
  pull_request:
    - opened
    - reopened
    - ready_for_review
    - synchronize
  push:
    branches:
      - '**'
    tags:
      - '!**'

jobs:
  check-for-secrets:
    runs-on: 'ubuntu-latest'
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Run Yelp's detect-secrets
        uses: RobertFischer/[email protected]
      - name: Commit back .secrets.baseline (if it was missing)
        uses: stefanzweifel/git-auto-commit-action@v4
        with:
          commit_message: "build(detect-secrets): Commit the newly-generated .secrets.baseline file"

Environment Variables

Key Value Description Default Value
DS_ADDL_ARGS Additional arguments to pass to the detect-secrets binary No additional arguments (ie: the empty string)
DS_REQUIRE_BASELINE If set to anything other than 0, we will fail the test if there is no baseline file 0 (ie: don't require baseline) ]

Usage Notes

If this action runs and does not see a detect-secrets baseline file at .secrets.baseline in the root of the repo, then the action will generate that baseline file for you. If you don't commit that file back, then this action is effectively an expensive no-op. The sample configuration above demonstrates how to commit back using the (git-auto-commit)[https://github.com/marketplace/actions/git-auto-commit] action.