Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: enable git leaks to check sensitive #11878

Merged
merged 3 commits into from
Jun 24, 2024
Merged

ci: enable git leaks to check sensitive #11878

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fefe4a0
ci: enable git leaks to check sensitive
wenytang-ms Jun 24, 2024
91c572e
ci: remove the detect logic
wenytang-ms Jun 24, 2024
5e9e3e9
ci: update logic
wenytang-ms Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 0 additions & 43 deletions .github/detect/excludes.txt
View file
Open in desktop

This file was deleted.

48 changes: 0 additions & 48 deletions .github/detect/regexes.json
View file
Open in desktop

This file was deleted.

117 changes: 0 additions & 117 deletions .github/detect/sensitive-detect.py
View file
Open in desktop

This file was deleted.

41 changes: 6 additions & 35 deletions .github/workflows/lint-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,45 +137,16 @@ jobs:
fi

check-sensitive-content:
if: ${{ github.event_name == 'pull_request' }}
if: ${{ github.event_name == 'pull_request' || (github.event_name == 'schedule' && (github.ref == 'refs/heads/dev'|| github.ref == 'refs/heads/main'))}}
runs-on: ubuntu-latest
steps:
- name: Checkout branch
uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{github.event.pull_request.head.repo.full_name}}

- name: prettier check files in PR on Fork
if: ${{ github.event.pull_request.head.repo.full_name != 'OfficeDev/TeamsFx' }}
run: |
git remote add upstream https://github.com/OfficeDev/TeamsFx.git
git fetch upstream ${{ github.event.pull_request.base.ref }}
git diff --diff-filter=MARC upstream/${{ github.event.pull_request.base.ref }}...HEAD --name-only >> diffFiles.txt

- name: prettier check files in PR on local
if: ${{ github.event.pull_request.head.repo.full_name == 'OfficeDev/TeamsFx' }}
run: |
git diff --diff-filter=MARC origin/${{ github.event.pull_request.base.ref }}...HEAD --name-only >> diffFiles.txt

- name: check content
run: |
touch diffFiles.txt
python .github/detect/sensitive-detect.py diff

schedule-check-sensitive-content:
if: ${{ github.event_name == 'schedule' && (github.ref == 'refs/heads/dev'|| github.ref == 'refs/heads/main' || github.ref == 'refs/heads/ga') }}
runs-on: ubuntu-latest
steps:
- name: checkout branch
uses: actions/checkout@v3
with:
token: ${{ secrets.CD_PAT }}
ref: ${{ github.ref }}
- name: check content
run: |
python .github/detect/sensitive-detect.py repo
- uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}

attension-on-version:
if: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' && github.event.action != 'edited' }}
Expand Down
Loading