Add Infisical Secrets Check Workflow #313
Conversation
WalkthroughA new GitHub Actions workflow file named Changes
Suggested labels
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
penify-dev
bot
changed the title
github-actions
bot
added
the
size/L
PR Review 🔍
|
PR Code Suggestions ✨
|
gstraccini
bot
added
the
☑️ auto-merge
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (6)
.github/workflows/infisical-secrets-check.yml (6)
1-10: LGTM! Consider removing the extra blank line.The workflow name, triggers, and concurrency settings are well-defined and appropriate for a secrets check workflow. The concurrency setting is a good practice to prevent redundant runs.
Consider removing the extra blank line at the beginning of the file:
- name: Infisical secrets check🧰 Tools
🪛 yamllint
[warning] 1-1: too many blank lines
(1 > 0) (empty-lines)
12-18: LGTM! Consider specifying an Ubuntu version.The job setup and permissions are well-defined. The permissions are appropriately set to the minimum required, which is a good security practice.
For better reproducibility, consider specifying an Ubuntu version instead of using
latest:- runs-on: ubuntu-latest + runs-on: ubuntu-22.04This ensures consistent behavior across different runs and environments.
🧰 Tools
🪛 yamllint
[error] 13-13: trailing spaces
(trailing-spaces)
26-36: LGTM! Consider using a custom Docker image and remove trailing spaces.The Infisical setup and tool installation steps are clear and use appropriate commands.
To improve workflow execution speed, consider creating a custom Docker image with Infisical and other required tools pre-installed. This can significantly reduce the time spent on setup in each workflow run.
Remove trailing spaces from lines 29, 32, and 36:
- curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash + curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash - run: | + run: | - npm install -g csv-to-markdown-table + npm install -g csv-to-markdown-table🧰 Tools
🪛 yamllint
[error] 29-29: trailing spaces
(trailing-spaces)
[error] 32-32: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
37-48: LGTM! Consider simplifying CSV processing.The scan execution and report generation steps are well-structured:
- The Infisical scan command includes redaction, which is good for security.
- Generating the report only on failure is an efficient approach.
The shell commands for CSV processing are complex and might be hard to maintain. Consider creating a separate script (e.g., Python) to handle CSV processing. This would improve readability and maintainability. For example:
- name: Generate report shell: bash if: failure() run: | if [[ -s secrets-result-raw.csv ]]; then python process_csv.py secrets-result-raw.csv secrets-result.csv secrets-result.md fiThen create a
process_csv.pyscript to handle the CSV processing logic.
50-69: LGTM! Fix indentation in artifact upload steps.The artifact upload steps are well-configured:
- Conditional uploads prevent unnecessary artifacts.
- Using a specific version of
actions/upload-artifact(v4) is a good practice.Fix the indentation for the 'path' key in two upload steps:
name: report-log - path: secrets-result.log + path: secrets-result.log name: report-md - path: secrets-result.md + path: secrets-result.mdEnsure consistent indentation of 10 spaces for all keys within the
withblock.
85-113: LGTM! Remove trailing spaces in the PR comment messages.The PR comment update step is well-structured:
- Using different messages for success, failure, and cancellation provides clear feedback.
- Including scan results and using a details section for the full report is informative and keeps the comment concise.
Remove trailing spaces from the PR comment messages:
- **Infisical secrets check:** :rotating_light: Secrets leaked! + **Infisical secrets check:** :rotating_light: Secrets leaked! - + - <summary>🔎 Detected secrets in your GIT history</summary> + <summary>🔎 Detected secrets in your GIT history</summary> - +This will improve code cleanliness and adhere to YAML best practices.
🧰 Tools
🪛 yamllint
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 108-108: trailing spaces
(trailing-spaces)
[error] 110-110: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
- .github/workflows/infisical-secrets-check.yml (1 hunks)
🧰 Additional context used
🪛 yamllint
.github/workflows/infisical-secrets-check.yml
[warning] 1-1: too many blank lines
(1 > 0) (empty-lines)
[error] 13-13: trailing spaces
(trailing-spaces)
[error] 29-29: trailing spaces
(trailing-spaces)
[error] 32-32: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
[warning] 76-76: wrong indentation: expected 10 but found 9
(indentation)
[warning] 83-83: wrong indentation: expected 10 but found 9
(indentation)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 108-108: trailing spaces
(trailing-spaces)
[error] 110-110: trailing spaces
(trailing-spaces)
🔇 Additional comments (2)
.github/workflows/infisical-secrets-check.yml (2)
21-24: LGTM! Appropriate repository checkout configuration.The repository checkout step is well-configured:
- Using a specific version of
actions/checkout(v4) is a good practice.- Setting
fetch-depth: 0ensures all history is fetched, which is necessary for a comprehensive secrets scan.
1-113: Overall assessment: Well-structured and effective secrets check workflow.This GitHub Actions workflow for Infisical secrets checking is well-designed and implements good practices for security scanning. The workflow effectively triggers on appropriate events, manages concurrency, and provides clear feedback through PR comments.
Key strengths:
- Appropriate triggers and concurrency settings.
- Minimal required permissions.
- Comprehensive repository checkout for thorough scanning.
- Conditional artifact uploads and report generation.
- Clear and informative PR comments with different messages for various outcomes.
Suggested improvements:
- Consider using a custom Docker image with pre-installed tools to speed up workflow execution.
- Simplify CSV processing by using a separate script.
- Fix minor indentation and trailing space issues.
- Specify an Ubuntu version for better reproducibility.
These improvements will enhance maintainability, reproducibility, and execution speed of the workflow.
🧰 Tools
🪛 yamllint
[warning] 1-1: too many blank lines
(1 > 0) (empty-lines)
[error] 13-13: trailing spaces
(trailing-spaces)
[error] 29-29: trailing spaces
(trailing-spaces)
[error] 32-32: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
[warning] 76-76: wrong indentation: expected 10 but found 9
(indentation)
[warning] 83-83: wrong indentation: expected 10 but found 9
(indentation)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 108-108: trailing spaces
(trailing-spaces)
[error] 110-110: trailing spaces
(trailing-spaces)
github-actions
bot
added
size/S
|
Infisical secrets check: ✅ No secrets leaked! 💻 Scan logs11:56PM INF scanning for exposed secrets...
11:56PM INF 285 commits scanned.
11:56PM INF scan completed in 199ms
11:56PM INF no leaks found
|
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferencesCodacy stopped sending the deprecated coverage status on June 5th, 2024. Learn more |
|
|
✅ Build VTEX-SDK-dotnet 2.3.1077 completed (commit ca6a475eb1 by @gstraccini[bot]) |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #313 +/- ##
=====================================
Coverage 0.22% 0.22%
=====================================
Files 117 117
Lines 1774 1774
Branches 75 75
=====================================
Hits 4 4
+ Misses 1770 1768 -2
- Partials 0 2 +2 ☔ View full report in Codecov by Sentry. |
User description
Closes #
📑 Description
✅ Checks
☢️ Does this introduce a breaking change?
ℹ Additional Information
Description
Changes walkthrough 📝
infisical-secrets-check.yml
Add Infisical Secrets Check Workflow.github/workflows/infisical-secrets-check.yml
Summary by CodeRabbit