Skip to content

Commit d1aca07

Browse files
Jeffreyhunggeoffg-sentryclaudecursoragent
authored
Allow truffle to fail silently on package fetch error (#216)
* skip the scan if setup steps failed, failed quietly * clean up and improvement on readability * fix logic gate for final step * fix(secret-scan): annotate the PR when the scan is skipped A setup failure now leaves a green check, so without an annotation there is no sign on the PR that the change went unscanned. Report which stage broke. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> * ci(secret-scan): drop redundant always() from the SIEM condition always() is true even when cancelled, so ANDing it with !cancelled() reduces to !cancelled(), which is the form GitHub recommends. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: geoffg-sentry <165922362+geoffg-sentry@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 2b42d6e commit d1aca07

1 file changed

Lines changed: 52 additions & 20 deletions

File tree

‎.github/workflows/secret-scan.yml‎

Lines changed: 52 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,18 @@ jobs:
66
runs-on: ubuntu-latest
77
permissions:
88
contents: "read"
9-
outputs:
10-
latest_release: ${{ steps.trufflehog_release.outputs.latest_release }}
11-
latest_tag_name: ${{ steps.trufflehog_release.outputs.latest_tag_name }}
129
steps:
1310
- name: Checkout Code
1411
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1512
- name: Install Cosign
13+
id: cosign
14+
continue-on-error: true
1615
# v4 of the action install v3 of the CLI. v4 of the CLI will deprecate some features so be aware.
1716
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
1817
- name: Pin Trufflehog to a known good release
1918
id: trufflehog_release
20-
shell: bash
19+
if: ${{ steps.cosign.outcome == 'success' }}
20+
continue-on-error: true
2121
env:
2222
GH_TOKEN: ${{ github.token }}
2323
run: |
@@ -35,42 +35,68 @@ jobs:
3535
done
3636
3737
if [[ -z "$LATEST_TAG_NAME" ]]; then
38-
echo "::error::No usable TruffleHog release found"
38+
echo "::warning::No usable TruffleHog release found"
3939
exit 1
4040
fi
4141
4242
echo "Using TruffleHog version: $LATEST_TAG_NAME"
4343
echo "latest_tag_name=$LATEST_TAG_NAME" >> "$GITHUB_OUTPUT"
4444
echo "latest_release=${LATEST_TAG_NAME#v}" >> "$GITHUB_OUTPUT"
4545
- name: Download and verify TruffleHog release
46+
id: download
47+
if: ${{ steps.trufflehog_release.outcome == 'success' }}
48+
continue-on-error: true
49+
env:
50+
TRUFFLEHOG_TAG: ${{ steps.trufflehog_release.outputs.latest_tag_name }}
51+
TRUFFLEHOG_VERSION: ${{ steps.trufflehog_release.outputs.latest_release }}
4652
run: |
47-
curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
48-
curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem
49-
curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig
50-
curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz
53+
base="https://github.com/trufflesecurity/trufflehog/releases/download/${TRUFFLEHOG_TAG}"
54+
for file in \
55+
"trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt" \
56+
"trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt.pem" \
57+
"trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt.sig" \
58+
"trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
59+
do
60+
curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors \
61+
-w '%{url_effective} %{http_code}\n' -O "${base}/${file}"
62+
done
5163
52-
cosign verify-blob trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt \
53-
--certificate trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem \
54-
--signature trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig \
64+
cosign verify-blob "trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt" \
65+
--certificate "trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt.pem" \
66+
--signature "trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt.sig" \
5567
--certificate-identity-regexp 'https://github\.com/trufflesecurity/trufflehog/\.github/workflows/.+' \
5668
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
5769
58-
sha256sum --ignore-missing -c trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
70+
sha256sum --ignore-missing -c "trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt"
5971
- name: Extract TruffleHog
72+
id: extract
73+
if: ${{ steps.download.outcome == 'success' }}
74+
env:
75+
TRUFFLEHOG_VERSION: ${{ steps.trufflehog_release.outputs.latest_release }}
6076
run: |
61-
tar xzf trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz -C /usr/local/bin
77+
tar xzf "trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz" -C /usr/local/bin
6278
chmod +x /usr/local/bin/trufflehog
6379
- name: Run TruffleHog scan
80+
if: ${{ steps.extract.outcome == 'success' }}
6481
continue-on-error: true
6582
id: scan
6683
run: |
84+
args=(git file://. --only-verified --github-actions --fail --exclude-detectors="datadogtoken,lob")
6785
if [ -e .secret_scan_ignore ]; then
68-
trufflehog git file://. --only-verified --github-actions --fail --exclude-paths=.secret_scan_ignore --exclude-detectors="datadogtoken,lob"
69-
else
70-
trufflehog git file://. --only-verified --github-actions --fail --exclude-detectors="datadogtoken,lob"
86+
args+=(--exclude-paths=.secret_scan_ignore)
7187
fi
88+
trufflehog "${args[@]}"
89+
- name: Report scan skipped
90+
if: ${{ !cancelled() && steps.scan.outcome == 'skipped' }}
91+
env:
92+
COSIGN_OUTCOME: ${{ steps.cosign.outcome }}
93+
RELEASE_OUTCOME: ${{ steps.trufflehog_release.outcome }}
94+
DOWNLOAD_OUTCOME: ${{ steps.download.outcome }}
95+
EXTRACT_OUTCOME: ${{ steps.extract.outcome }}
96+
run: |
97+
echo "::warning::TruffleHog unavailable, this change was not scanned: cosign=$COSIGN_OUTCOME release=$RELEASE_OUTCOME download=$DOWNLOAD_OUTCOME extract=$EXTRACT_OUTCOME"
7298
- name: Send Alert to SIEM
73-
id: alert
99+
if: ${{ !cancelled() }}
74100
env:
75101
SIEM_WEBHOOK_URL: ${{ vars.SECRET_SCAN_SIEM_WEBHOOK_URL }}
76102
SCAN_OUTCOME: ${{ steps.scan.outcome }}
@@ -94,9 +120,15 @@ jobs:
94120
pull_request=""
95121
fi
96122
123+
if [[ "$SCAN_OUTCOME" == "skipped" ]]; then
124+
status="setup_failed"
125+
else
126+
status="$SCAN_OUTCOME"
127+
fi
128+
97129
jq -n \
98130
--arg event "github_secret_scanning" \
99-
--arg status "$SCAN_OUTCOME" \
131+
--arg status "$status" \
100132
--arg createdAt "$created_at" \
101133
--arg repo "$REPO" \
102134
--arg pull_request "$pull_request" \
@@ -108,5 +140,5 @@ jobs:
108140
"$SIEM_WEBHOOK_URL" \
109141
|| echo "::warning::SIEM alert failed (non-blocking)"
110142
- name: Fail workflow if secret detected
111-
if: ${{ !cancelled() && steps.scan.outcome != 'success' }}
143+
if: ${{ !cancelled() && steps.scan.outcome == 'failure' }}
112144
run: exit 1

0 commit comments

Comments
 (0)