Update persist-credentials setting in workflow #817
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Entropy Beauty + TruffleHog Scan | |
| on: | |
| push: | |
| release: | |
| pull_request: | |
| permissions: | |
| contents: read # minimal for analysis | |
| # no write permissions here | |
| jobs: | |
| scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # For pull_request this is the PR head – safe because we have no write token | |
| fetch-depth: 0 # or 2 if you prefer | |
| persist-credentials: false | |
| - name: Setup Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.12' | |
| - name: Run TruffleHog | |
| uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0 | |
| with: | |
| path: . | |
| extra_args: --results=verified,unknown --filter-entropy=3.5 --json | |
| # Optional: continue-on-error: true if you don't want the job to fail on findings | |
| - name: Compute mid-4 beauty entropy | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || '' }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: python .github/workflows/compute-entropy.py | |
| - name: Upload scan results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: scan-results | |
| path: | | |
| /tmp/beauty.json | |
| trufflehog.json # if TruffleHog wrote it; adjust if needed | |
| retention-days: 1 | |
| # ── Create issue on push/release (trusted events) ── | |
| - name: Create issue on suspicious push | |
| if: github.event_name == 'push' || github.event_name == 'release' | |
| uses: actions/github-script@v7 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const fs = require('fs'); | |
| const beauty = JSON.parse(fs.readFileSync('/tmp/beauty.json', 'utf8')); | |
| if (beauty.average_entropy >= 4.3 && beauty.average_entropy <= 5.1) { | |
| console.log("✅ Mid-4 beauty — no issue created"); | |
| return; | |
| } | |
| let findings = []; | |
| if (fs.existsSync('trufflehog.json')) { | |
| try { | |
| const lines = fs.readFileSync('trufflehog.json', 'utf8').trim().split('\n'); | |
| findings = lines.map(line => { | |
| try { return JSON.parse(line); } catch(e) { return null; } | |
| }).filter(Boolean); | |
| } catch(e) {} | |
| } | |
| let body = `**Average entropy:** ${beauty.average_entropy} bits/char\n\n`; | |
| body += `**Verdict:** ${beauty.verdict}\n\n`; | |
| if (beauty.files && beauty.files.length) { | |
| body += `**Changed files:**\n\`\`\`\n${beauty.files.join('\n')}\n\`\`\`\n\n`; | |
| } | |
| if (findings.length > 0) { | |
| body += `**TruffleHog found ${findings.length} potential issue(s)**\n`; | |
| } else { | |
| body += `✅ No secrets or suspicious high-entropy strings found.\n`; | |
| } | |
| body += `\n*Triggered by ${context.eventName} to \`${context.sha}\` — mid-4 beauty heuristic*`; | |
| await github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: `🚨 Suspicious entropy detected in recent ${context.eventName} (${beauty.average_entropy})`, | |
| body: body, | |
| labels: ['entropy', 'security', 'review-needed'] | |
| }); |