Skip to content

Conversation

@darliiin
Copy link
Contributor

@darliiin darliiin commented Apr 25, 2025

Summary

Task: SD-1248

  • Vulnerability checking is separated from secrets checking
    • secret-checks should be mandatory for all repositories
    • vulns-check is optional, it should not block PRs
    • in slack channel team-devops-expose-secrets will receive alerts only about keys
    • in PR you can disable comments using variable enable-pr-comment: false in workflow
    • three duplicate steps for both checks are taken out into separate actions - prepare-vulns-secrets-env

PR comment on secrets
image

PR comment on vulnerabilities
image

test PR: https://github.com/saritasa-nest/probot-tests/pull/364
workflow: secret-vuln-checks.yaml

@darliiin darliiin added WIP and removed Needs review labels Apr 28, 2025
@darliiin darliiin marked this pull request as draft April 28, 2025 06:15
if: always()
shell: bash
run: |
cat pr-comment.md > $GITHUB_STEP_SUMMARY
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where is GITHUB_STEP_SUMMARY used?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a summary in action
image

@darliiin darliiin added Needs review and removed WIP labels May 7, 2025
@darliiin darliiin marked this pull request as ready for review May 7, 2025 07:45
Copy link

@kseniyashaydurova kseniyashaydurova left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job, Dasha!

@darliiin darliiin merged commit b7cb47b into main May 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants