From fb0ff41f297fa9f121a92b1ea32ee57096476bb2 Mon Sep 17 00:00:00 2001 From: "Ralf W. Grosse-Kunstleve" Date: Fri, 30 Oct 2026 21:17:38 -0700 Subject: [PATCH] fix(secret-scan): use a shallow checkout for filesystem scans Signed-off-by: Ralf W. Grosse-Kunstleve --- .github/workflows/README.md | 1 + .github/workflows/secret-scan-pulse.yml | 5 +++-- CHANGELOG.md | 4 ++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 9b0deb6..c556e18 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -127,6 +127,7 @@ for this repository's own self-tests. ### Secret scan — [`secret-scan-pulse.yml`](secret-scan-pulse.yml) CI enforcement lane. Runs the Pulse Secret Scanner container and publishes redacted SARIF to the repository Security tab. +The filesystem scan covers checked-out files, not Git history. Its shallow checkout avoids downloading unrelated branch histories. The companion local-advisory lane is the `secret-scan-trufflehog`. **pre-commit hook** (open-source [`trufflesecurity/trufflehog`](https://github.com/trufflesecurity/trufflehog)) declared in [`.pre-commit-hooks.yaml`](../../.pre-commit-hooks.yaml). diff --git a/.github/workflows/secret-scan-pulse.yml b/.github/workflows/secret-scan-pulse.yml index 4b9cc55..73b114b 100644 --- a/.github/workflows/secret-scan-pulse.yml +++ b/.github/workflows/secret-scan-pulse.yml @@ -49,10 +49,11 @@ jobs: env: PULSE_IMAGE: ${{ vars.SECRET_SCAN_PULSE_IMAGE }}:${{ vars.SECRET_SCAN_PULSE_IMAGE_TAG }} steps: - - name: Checkout (full history for secret scan) + - name: Checkout source for filesystem secret scan uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - fetch-depth: 0 + # The filesystem scan reads checked-out files, not Git history. + fetch-depth: 1 persist-credentials: false # don't leave GITHUB_TOKEN in .git for the scanned tree # CI self-test only. Plants a disposable finding so the negative failure_policy paths can be exercised end-to-end. diff --git a/CHANGELOG.md b/CHANGELOG.md index b279127..151d213 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -32,6 +32,10 @@ Additive release. Existing suite callers need no change: `enable-vuln-scan` and - Security suite — the preflight reports *every* missing companion input in one run rather than exiting on the first. - Pin policy — the recommended pre-commit `rev:` pin is now the 40-character commit SHA with the release tag as a `# frozen:` comment, the form `pre-commit autoupdate --freeze` writes, matching the SHA pin already required for reusable workflows. Existing release-tag pins keep working; switch with `pre-commit autoupdate --freeze` at the next refresh. See [Pin policy per surface](README.md#pin-policy-per-surface). +### Fixed + +- Secret scan (Pulse): use a shallow checkout for the filesystem scan instead of downloading every branch and tag's history, avoiding large unrelated branches such as `gh-pages`. + ### Known limitations - **SARIF publication is a follow-up.** Findings land in the job summary and an optional artifact, not the Security tab.