ci(security): run the API secret scan unauthenticated - #234
Conversation
Fixes the job that failed on main right after #230 merged: `403 Resource not accessible by integration` from `GET /user`. TruffleHog's GitHub source calls `/user` to identify whose token it holds, and an installation token cannot read that endpoint. There is no flag to skip the call, so `GITHUB_TOKEN` is unusable for this source. This repository is public, so the scan needs no token — measured unauthenticated: 8651 chunks in 8 seconds, the same coverage the token-authenticated run produced, and 0 findings either way. Caught by running it for real rather than by review: on pull requests this job is skipped by design, so the first execution was the push to main. Refs #231 Signed-off-by: Grigoriy Gogin <Grigoriy.Gogin@constructor.tech>
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe ChangesTruffleHog scan configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Same fix as #234, carried here so this branch is self-consistent: GITHUB_TOKEN cannot be used with TruffleHog's GitHub source, which calls GET /user and gets 403 for an installation token. The repository is public, so no token is needed. Refs #231 Signed-off-by: Grigoriy Gogin <Grigoriy.Gogin@constructor.tech>
Carries @cyberantonz's second review pass from constructorfabric/insight#2016 over to this repository, where the same code runs. The summary steps parsed every line with a bare `json.loads`, so one truncated line would kill the report on a job that exists to report. Parsing is now guarded: an unparsable line is counted, and a record without `DetectorName` is not a finding and no longer inflates the count. Both counters print when non-zero, so nothing is dropped silently. Verified on a file with two real findings, one truncated line and one valid non-finding record: exit 0, "1 unparsable line(s), 1 non-finding record(s) skipped", 2 findings reported. Comments lost the rationale and the measurements that would rot — why MEDIUM/LOW was reverted, chunk counts, finding counts. What stayed is compressed to the invariant a maintainer must not break: keep this scan unauthenticated, do not switch to `--ignorefile`. Refs #231 Signed-off-by: Grigoriy Gogin <Grigoriy.Gogin@constructor.tech>
2 participants
Fixes the
secrets (GitHub API)job, which failed onmainimmediately after #230 merged:Cause
TruffleHog's GitHub source calls
GET /userto identify whose token it holds.GITHUB_TOKENis an installation token and cannot read that endpoint, and there is no flag to skip the call — soGITHUB_TOKENis unusable for this source, full stop.This repository is public, so the scan needs no token at all. Measured unauthenticated: 8651 chunks in 8 seconds, the same coverage the authenticated run produced locally (8608 chunks), and 0 findings either way.
Why review did not catch it
The job is skipped on pull requests by design — it depends on API availability, so a transient outage must not colour a PR. That made the push to
mainits first real execution. The lesson is on me: a job that never runs in the PR that introduces it needs a manual dispatch before merge, not after.Test plan
actionlintcleanmainsecrets (GitHub API)green onmain— verified by this PR's own merge, since that is the only event that runs itRefs constructorfabric/insight#2079
Summary by CodeRabbit