Secret Detection Workflow

Overview

The detect-secrets.yml workflow implements automated secret detection using the reviewdog/action-detect-secrets GitHub Action. This action uses Yelp’s detect-secrets tool with reviewdog integration to scan for potential secrets in your codebase.

Features

• Comprehensive Scanning: Scans all files using all available plugins
• Smart Filtering: Excludes common false positives and non-source files
• Baseline Management: Uses .secrets.baseline to track known/approved findings
• Pull Request Integration: Reviews findings directly in PR comments
• Self-hosted Runner: Optimized for your existing CI infrastructure

Configuration

Triggers

• Pull requests (opened, synchronized, reopened)
• Pushes to main/master/develop branches

Exclusions

The workflow is configured to exclude:

File Types:

• Lock files (*.lock)
• Minified files (*.min.js, *.min.css)
• Dependency directories (vendor/, node_modules/)
• Generated files (coverage/, log/, tmp/, public/packs/, public/assets/)
• Credential directories (credentials/, aws_keys/)
• Backup/cache directories (spec_backup/, .scannerwork/)

Content Patterns:

• Test-related content: test, example, dummy, fake, mock
• Integrity hashes: integrity=, sha256, sha512, etc.
• Rails tokens: csrf-token, authenticity_token
• Common words: password, secret, key, token

Files

.secrets.baseline

This file contains a snapshot of all currently detected secrets that have been reviewed and approved. When the workflow runs:

• New secrets not in the baseline will be flagged
• Secrets in the baseline are considered “known good”
• You can update the baseline when legitimate secrets are added

Updating the Baseline

To update the baseline after adding legitimate secrets:

# Generate new baseline
detect-secrets scan --all-files --force-use-all-plugins \
  --exclude-files '\.lock$' \
  --exclude-files '\.min\.js$' \
  --exclude-files '\.min\.css$' \
  --exclude-files 'vendor/' \
  --exclude-files 'node_modules/' \
  --exclude-files 'coverage/' \
  --exclude-files 'log/' \
  --exclude-files 'tmp/' \
  --exclude-files '\.git/' \
  --exclude-files 'public/packs/' \
  --exclude-files 'public/assets/' \
  --exclude-files 'credentials/' \
  --exclude-files 'aws_keys/' \
  --exclude-files 'spec_backup/' \
  --exclude-files '\.scannerwork/' \
  --exclude-secrets 'password|secret|key|token' \
  --exclude-lines 'test|example|dummy|fake|mock|integrity=|sha\d+|csrf-token|authenticity_token' \
  > .secrets.baseline

# Review and mark findings as real or false positives
detect-secrets audit .secrets.baseline

Reviewdog Integration

The workflow uses reviewdog with the following settings:

• Reporter: github-pr-review (adds review comments to PRs)
• Level: warning (marks findings as warnings)
• Fail Level: error (fails CI only on error-level findings)

Common False Positives

The configuration already handles many common false positives:

1. CDN Integrity Hashes: SHA hashes in script/link tags
2. Rails CSRF Tokens: Authenticity tokens in forms
3. Test Data: Test passwords, mock tokens, example values
4. Build Artifacts: Compiled assets, dependencies
5. Documentation: Example configurations, dummy values

Workflow Comparison

This detect-secrets workflow complements your existing security workflows:

Maintenance

When Secrets are Found

1. Real Secret: Remove from code, rotate if exposed, update baseline
2. False Positive: Add to exclusion patterns or mark as safe in baseline
3. Test Data: Ensure it’s properly marked as test content

Regular Tasks

• Review baseline quarterly for outdated entries
• Update exclusion patterns as needed
• Monitor for new secret types that need filtering

Benefits

• Early Detection: Catches secrets before they reach production
• Automated Review: Integrates with your PR workflow
• Customizable: Extensive filtering options for your codebase
• Baseline Management: Tracks known good vs. new findings
• Multiple Reporters: Flexible output formats (PR comments, checks, etc.)

This workflow significantly enhances your repository’s security posture by automatically detecting potential secrets and integrating the review process into your existing GitHub workflow.