Skip to content
Merged
29 changes: 29 additions & 0 deletions .github/workflows/secrets-scan.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Secrets Scan
on:
pull_request:
types: [opened, synchronize, reopened]
jobs:
security-secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: '2'
ref: '${{ github.event.pull_request.head.ref }}'
- run: |
git reset --soft HEAD~1
- name: Install Talisman
run: |
# Download Talisman
wget https://github.com/thoughtworks/talisman/releases/download/v1.37.0/talisman_linux_amd64 -O talisman

# Checksum verification
checksum=$(sha256sum ./talisman | awk '{print $1}')
if [ "$checksum" != "8e0ae8bb7b160bf10c4fa1448beb04a32a35e63505b3dddff74a092bccaaa7e4" ]; then exit 1; fi

# Make it executable
chmod +x talisman
- name: Run talisman
run: |
# Run Talisman with the pre-commit hook
./talisman --githook pre-commit
3 changes: 3 additions & 0 deletions .talismanrc
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
fileignoreconfig:
- filename: .github/workflows/secrets-scan.yml
ignore_detectors:
- filecontent
- filename: src/commands/launch/index.test.ts
checksum: 9db6c02ad35a0367343cd753b916dd64db4a9efd24838201d2e1113ed19c9b62
version: "1.0"