DragonSlayer_14andClaude Sonnet 5
cbd1bcf99b
Testing Build, Check & Preview Release / Build, Check & Create Preview Release (push) Skipped
Code Quality (Auto-Format & Clippy-Fix) / Formatierung & Clippy automatisch beheben (push) Successful in 1m6s
Security Scans / Trivy & OSV-Scanner (push) Successful in 1m15s
Nightly Build & Publish / Erkenne relevante Code-Änderungen (push) Successful in 12s
TruffleHog Secret Scan / TruffleHog (push) Successful in 23s
Nightly Build & Publish / Build & Publish Nightly-Crate zur Gitea Registry (push) Successful in 2m41s
- Neuer Workflow "nightly-pr.yaml": Erstellt und merged taeglich automatisch einen Pull Request von dev nach nightly (09:00 Uhr Europe/Berlin); legt den nightly-Branch bei Bedarf initial von dev an. - Neuer Workflow "nightly.yaml": Testet, paketiert und veroeffentlicht bei Aenderungen auf nightly eine Pre-Release-Version (-nightly.<Zeitstempel>) in die Gitea Cargo Registry; erstellt bewusst kein Gitea-Release. - testing.yaml veroeffentlicht nun zusaetzlich eine Pre-Release-Version (-testing.<Zeitstempel>) in die Gitea Cargo Registry, zusaetzlich zum bisherigen Preview-Release mit Crate-Anhang. - Beide Versions-Suffixe sind SemVer-Pre-Releases, wodurch Renovates Standardverhalten (ignoreUnstable) sie automatisch ignoriert. - CRON_TZ=Europe/Berlin in security-scan.yaml und trufflehog-scan.yaml ergaenzt: Gitea Actions interpretiert schedule-Cron sonst in der lokalen Zeitzone des Gitea-Servers statt in der beabsichtigten Zeitzone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
60 lines
2.0 KiB
YAML
60 lines
2.0 KiB
YAML
name: TruffleHog Secret Scan
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
schedule:
|
|
- cron: "CRON_TZ=Europe/Berlin 0 6 * * 1"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
trufflehog-scan:
|
|
name: TruffleHog
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TRUFFLEHOG_VERSION: "3.97.5"
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Lokales bin-Verzeichnis zum PATH hinzufügen
|
|
run: |
|
|
mkdir -p "$HOME/.local/bin"
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Cache TruffleHog-Binary
|
|
id: cache-trufflehog
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/.local/bin/trufflehog
|
|
key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }}
|
|
|
|
- name: Install TruffleHog
|
|
if: steps.cache-trufflehog.outputs.cache-hit != 'true'
|
|
run: |
|
|
curl -fsSL -o trufflehog.tar.gz \
|
|
"https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
|
|
tar -xzf trufflehog.tar.gz trufflehog
|
|
chmod +x trufflehog
|
|
mv trufflehog "$HOME/.local/bin/trufflehog"
|
|
rm trufflehog.tar.gz
|
|
|
|
- name: Run TruffleHog Scanner
|
|
run: |
|
|
set +e
|
|
trufflehog git file://. --results=verified,unknown --fail --json > trufflehog-results.json
|
|
echo "TRUFFLEHOG_EXIT=$?" >> "$GITHUB_ENV"
|
|
|
|
- name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
|
|
env:
|
|
GITEA_URL: ${{ gitea.server_url || github.server_url }}
|
|
REPO: ${{ gitea.repository || github.repository }}
|
|
TOKEN: ${{ secrets.SECURITY_TOKEN }}
|
|
RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
|
|
ISSUE_TITLE: "Security-Scan: TruffleHog Secrets"
|
|
ISSUE_LABEL: "security-scan-trufflehog"
|
|
run: |
|
|
python3 scripts/report-security-issue.py "" "" trufflehog-results.json
|