Compliance: secret_scan_ci_job_present #96

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   on Apr 9, 2026
2. don-petry commented on Apr 9, 2026

   

   don-petry

   on Apr 9, 2026

   ContributorAuthor

   More actions

   Weekly Compliance Audit (2026-04-09)

   This finding is still open.

   Detail: ci.yml does not contain a job using gitleaks — add the secret-scan job from the standard

   Standard: standards/push-protection.md#required-ci-job
3. don-petry

   added

   claude

   on Apr 9, 2026
4. don-petry commented on Apr 9, 2026

   

   don-petry

   on Apr 9, 2026

   Last edited by don-petry

   ContributorAuthor

   More actions

   Claude encountered an error —— View job

   ---

   I'll analyze this and get back to you.
5. don-petry commented on Apr 10, 2026

   

   don-petry

   on Apr 10, 2026

   ContributorAuthor

   More actions

   Weekly Compliance Audit (2026-04-10)

   This finding is still open.

   Detail: ci.yml does not contain a job using gitleaks — add the secret-scan job from the standard

   Standard: standards/push-protection.md#required-ci-job
6. don-petry

   added

   claude

   and removed

   claude

   on Apr 14, 2026
7. don-petry commented on Apr 14, 2026

   

   don-petry

   on Apr 14, 2026

   Last edited by don-petry

   ContributorAuthor

   More actions

   Claude finished @don-petry's task in 9m 4s —— View job • claude/issue-96-20260414-1305 • Create PR ➔

   ---

   Issue #96: Add gitleaks secret-scan job to ci.yml

   • Gather context: read current ci.yml and the org standard
   • Fetch the required CI job template from the standard
   • Look up SHA for any actions needed (pinning policy)
   • Add the gitleaks secret-scan job to ci.yml
   • Commit and push changes
   • Create a pull request — #107
   • Fix CI failure 1: gitleaks-action v2 requires GITLEAKS_LICENSE for org repos — switched to direct gitleaks binary install (v8.30.1)
   • Fix CI failure 2: 7 false-positive findings in old commit — added .gitleaksignore with fingerprints
   • CI passes — Secret scan (gitleaks): SUCCESS
   • Tagged code owner (@don-petry) for review

   Summary

   Added the required secret-scan CI job per the push-protection standard. Key decisions:

   • Direct binary install instead of gitleaks-action: gitleaks/gitleaks-action v2 requires a paid GITLEAKS_LICENSE for organization repos, so gitleaks v8.30.1 is installed directly and invoked with --redact --verbose --exit-code 1
   • .gitleaksignore: 7 false-positive findings in commit 865de69b (file paths containing "api-key" in BMAD documentation CSV/markdown files) were suppressed via fingerprints
8. don-petry

   added a commit that references this issue on Apr 14, 2026

   ci: add gitleaks secret-scan job to ci.yml (closes #96)

   ...

   This issue will close once commit fa32108 is merged into the 'main' branch.

   fa32108
9. don-petry commented on Apr 17, 2026

   

   don-petry

   on Apr 17, 2026

   ContributorAuthor

   More actions

   Weekly Compliance Audit (2026-04-17)

   This finding is still open.

   Detail: ci.yml does not contain a job using gitleaks — add the secret-scan job from the standard

   Standard: standards/push-protection.md#required-ci-job
10. don-petry

    added

    claude

    and removed

    claude

    on Apr 18, 2026
11. don-petry commented on Apr 18, 2026

    

    don-petry

    on Apr 18, 2026

    Last edited by don-petry

    ContributorAuthor

    More actions

    Claude finished @don-petry's task in 13s —— View job • claude/issue-96-20260418-1841 • [Create PR ➔](https://github.com/petry-projects/markets/compare/main...claude/issue-96-20260418-1841?quick_pull=1&title=Issue%20%2396%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2396%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    ---

    Issue #96: Add gitleaks secret-scan job to ci.yml

    

    • Gather context: check current ci.yml and PR ci: add gitleaks secret-scan job to ci.yml #107 status
    • Read the push-protection standard for required CI job format
    • Add secret-scan job using gitleaks/gitleaks-action (compliance check requires this)
    • Add .gitleaksignore for known false positives from git history
    • Commit and push changes
    • Create pull request — #119
    • Self-review: job structure matches standard, SHA pinned, permissions correct
    • Monitor CI and fix failures (waiting for CI results)
    • Tag code owners for review

    Why PR #107 didn't close the issue: PR #107 used a direct binary install of gitleaks. The compliance audit check (pp_check_secret_scan_ci_job) regex specifically looks for uses: gitleaks/gitleaks-action@ — binary install doesn't match. This PR switches to gitleaks/gitleaks-action@v2.3.9 (SHA-pinned).

    ⚠️ Action needed for CI: gitleaks-action v2 requires a free GITLEAKS_LICENSE key for GitHub org repos. Please set this as a repo or org secret named GITLEAKS_LICENSE (get one at gitleaks.io). The CI job will fail without it.
    • claude/issue-96-20260418-1841
12. don-petry

    added a commit that references this issue on Apr 18, 2026

    ci: add gitleaks secret-scan job using gitleaks-action

    ...

    This issue will close once commit 10b3be3 is merged into the 'main' branch.

    10b3be3
13. don-petry

    removed

    claude

    on Apr 19, 2026
14. 29 remaining items

    Load more
15. don-petry

    added

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    on Jun 10, 2026
16. don-petry commented on Jun 10, 2026

    

    don-petry

    on Jun 10, 2026

    ContributorAuthor

    More actions

    Dev-Lead Implementation Plan

    Issue: #96 — Compliance: secret_scan_ci_job_present

    Scope

    Replace the manual gitleaks installation in the secret-scan CI job with the gitleaks/gitleaks-action GitHub Action, which is required by the org push-protection standard for the secret_scan_ci_job_present compliance check.

    Implementation Checklist

    • .github/workflows/ci.yml — replace the "Install gitleaks" + "Run gitleaks" steps with a single gitleaks/gitleaks-action action step; add security-events: write permission to the job

    Tests to Write

    • N/A — pure CI workflow configuration change; no application logic or unit-testable behavior. TDD Phase 2 skipped per the exception for configuration-only changes.

    Test Command

    bash ".dev-lead/scripts/dev-lead-lint.sh"
17. don-petry commented on Jun 10, 2026

    

    don-petry

    on Jun 10, 2026

    ContributorAuthor

    More actions

    Dev-Lead: Implementation Complete

    Plan Execution

    • .github/workflows/ci.yml — replaced manual gitleaks install with gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9; added security-events: write permission; added GITHUB_TOKEN env var

    Test Results

    [lint] shellcheck: no .sh files found — skipping
      [lint] all checks passed
    

    Files Changed

    • .github/workflows/ci.yml: replaced the two-step manual gitleaks download/run with a single gitleaks/gitleaks-action step to satisfy the secret_scan_ci_job_present compliance check

    Notes

    • TDD Phase 2 skipped: this is a pure CI configuration change with no application logic to unit-test.
    • The compliance check secret_scan_ci_job_present greps for gitleaks/gitleaks-action in ci.yml; the previous implementation used a manual curl install and binary invocation, which did not match that pattern.
    • SHA pinned per org Action Pinning Policy. fetch-depth: 0 retained for full history scanning. --redact and --exit-code 1 flags preserved.
    • The .github/checksums/gitleaks_8.30.1_linux_x64.sha256sum file is no longer referenced by any workflow step; it can be removed in a follow-up cleanup but is out of scope for this issue.
18. don-petry

    added a commit that references this issue on Jun 10, 2026

    feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263

    ...

    d22f036
19. don-petry

    closed this as completedin #263on Jun 10, 2026
20. don-petry

    added 2 commits that reference this issue on Jun 19, 2026

    ci: add gitleaks secret-scan job to ci.yml (#124)

    ...

    This issue will close once commit 51c93e7 is merged into the 'main' branch.

    51c93e7

    feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263

    ...

    This issue will close once commit f87e5ac is merged into the 'main' branch.

    f87e5ac
21. don-petry

    added 4 commits that reference this issue on Aug 4, 2026

    feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263

    ...

    e7b3e5b

    feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (

    ...

    e852a49

    feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263

    ...

    16dd6c2

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    ...

    93726a6
22. don-petry

    added 4 commits that reference this issue on Aug 14, 2026

    feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263

    ...

    bb9f791

    feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (

    ...

    7ae9d8f

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    ...

    25b4835

    feat: implement issue #400 — Compliance: ruleset-bypass-dependabot-co…

    ...

    af4d65d