Skip to content

Compliance: secret_scanning_non_provider_patterns #252

Closed
#422
Closed
Compliance: secret_scanning_non_provider_patterns#252
#422
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on May 12, 2026

Compliance Finding

Category: push-protection
Severity: warning
Check: secret_scanning_non_provider_patterns

Detail

Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

Standard Reference

standards/push-protection.md#required-repo-level-settings

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    claude
    compliance-auditAutomated compliance audit finding
    on May 12, 2026

  2. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  3. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  4. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  5. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  6. don-petry commented on May 13, 2026

    @don-petry
    don-petry
    on May 13, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-13)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  7. don-petry commented on May 15, 2026

    @don-petry
    don-petry
    on May 15, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-15)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  8. don-petry
    added
    claude
    and removed
    claude
    on May 20, 2026

  9. 20 remaining items

  10. don-petry commented on May 30, 2026

    @don-petry
    don-petry
    on May 30, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-30)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  11. don-petry commented on May 30, 2026

    @don-petry
    don-petry
    on May 30, 2026
    ContributorAuthor

    @don-petry-dev-lead

  12. don-petry commented on Jun 5, 2026

    @don-petry
    don-petry
    on Jun 5, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-06-05)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  13. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    claude
    dev-leadFor dev-lead agent pickup
    on Jun 6, 2026

  14. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #252 — Compliance: secret_scanning_non_provider_patterns

    Scope

    The compliance audit flags this repo because security_and_analysis.secret_scanning_non_provider_patterns.status is disabled on GitHub. The existing scripts/compliance-remediate.sh script already auto-fixes most settings-level findings via the GitHub API but routes every push-protection/* finding straight to the "skipped" pile, so this finding has been re-opened by the weekly audit since 2026-05-12.

    This change adds an auto-remediation path for the specific push-protection/secret_scanning_non_provider_patterns finding so the next remediation run flips the setting via API (the same call apply-repo-settings.sh would make, scoped to the single key the audit reported).

    Implementation Checklist

    • Add remediate_security_analysis_setting() helper in scripts/compliance-remediate.sh that PATCHes security_and_analysis.<key>.status via stdin (since gh api -F cannot send nested JSON).
    • Wire push-protection/secret_scanning_non_provider_patterns into the dispatcher above the existing push-protection/* catch-all so it routes to the new helper instead of being skipped.
    • Keep the existing push-protection/* catch-all for the other push-protection findings (open alerts, CI gitleaks job, gitignore, bypasses) since they each require a different remediation path.

    Tests to Write

    • test/scripts/compliance-remediate/security-analysis.bats — using the existing gh stub pattern from test/workflows/feature-ideation/stubs/gh:
      • dispatcher routes push-protection/secret_scanning_non_provider_patterns to the security-analysis remediator (was previously skipped)
      • remediator issues gh api -X PATCH repos/<org>/<repo> with the nested security_and_analysis payload
      • dry-run mode does NOT call the API
      • other push-protection/* checks (e.g. open_secret_alerts) still hit the skip path
      • failed PATCH (gh exit != 0) reports a failure rather than silent success

    Test Command

    bats test/scripts/compliance-remediate/

    The full repo lint will also run: bash .dev-lead/scripts/dev-lead-lint.sh (shellcheck on all scripts/**/*.sh).

  15. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Added remediate_security_analysis_setting() helper in scripts/compliance-remediate.sh (PATCHes the nested security_and_analysis object via stdin, since gh api -F only sends flat form fields).
    • Wired push-protection/secret_scanning_non_provider_patterns into the dispatcher above the push-protection/* catch-all.
    • Catch-all preserved for the other push-protection findings (open alerts, CI gitleaks job, gitignore baseline, recent bypasses) — each of those needs a different remediation path and stays skipped for now.
    • New bats test suite under test/scripts/compliance-remediate/ (helper + gh stub + 4 cases).

    Test Results

    $ bats test/scripts/compliance-remediate/security-analysis.bats
1..4
ok 1 applies PATCH to security_and_analysis for secret_scanning_non_provider_patterns
ok 2 dry-run does not call the GitHub API but records the planned change
ok 3 failed PATCH is reported as a failure
ok 4 non-remediated push-protection findings still hit the skip path

$ bats -r test/        # full suite
1..155
... (all 155 tests pass)

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck on 12 file(s)...
  [lint] all checks passed

    Files Changed

    • scripts/compliance-remediate.sh — new remediate_security_analysis_setting() function (+33 lines) and one dispatcher case (+3 lines) wiring push-protection/secret_scanning_non_provider_patterns to it.
    • test/scripts/compliance-remediate/security-analysis.bats — new bats suite covering apply, dry-run, failure, and catch-all paths.
    • test/scripts/compliance-remediate/helpers/setup.bash — bats helper mirroring test/workflows/feature-ideation/helpers/setup.bash.
    • test/scripts/compliance-remediate/stubs/gh — env-driven gh stub mirroring test/workflows/feature-ideation/stubs/gh, extended with GH_STUB_STDIN_LOG so tests can assert on JSON payloads sent via --input -.

    Notes

    • This change adds the auto-remediation path; the underlying setting on petry-projects/.github flips to enabled only when compliance-remediate.sh runs with a token that has repo-admin permission (as documented in standards/push-protection.md#required-repo-level-settings). PR feat: add compliance-remediate.sh — close the audit -> auto-fix -> PR loop #220 noted the workflow wiring step is gated on a PAT with workflow scope, which this agent cannot modify.
    • Scope kept narrow per the issue: only secret_scanning_non_provider_patterns is wired in. The other four security_and_analysis settings (secret_scanning, secret_scanning_push_protection, secret_scanning_ai_detection, dependabot_security_updates) are currently enabled on this repo, so no remediation entry is needed for them — they can be added later by following the same pattern if they ever regress.
    • No new bats CI workflow is wired for test/scripts/compliance-remediate/ (a workflow file change would need workflow scope). Running bats -r test/ locally executes the new suite alongside the existing 151 tests; the existing Feature Ideation Tests workflow does not exercise these files.

  16. don-petry commented on Jun 10, 2026

    @don-petry
    don-petry
    on Jun 10, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-06-10)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings

  17. don-petry
    added a commit that references this issue on Jun 10, 2026

    feat: implement issue #252 — Compliance: secret_scanning_non_provider…

    918f12c
  18. don-petry
    closed this as completedin #422on Jun 10, 2026
  19. don-petry
    added a commit that references this issue on Jun 11, 2026

    feat: implement issue #252 — Compliance: secret_scanning_non_provider…

    25b0a21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions