Secret Scanning

# .github/secret-scanning.yml
# Custom patterns for organization-specific secrets
custom-patterns:
  - name: Internal API Key
    pattern: |
      (?i)(api[_-]?key|apikey)[\s]*[=:][\s]*['"]?(?<secret>[a-zA-Z0-9]{32,64})['"]?
    confidence: high

  - name: Database Connection String
    pattern: |
      (?i)(db[_-]?url|database[_-]?url|connection[_-]?string)[\s]*[=:][\s]*['"]?(?<secret>postgres(ql)?://[^'"]+)['"]?
    confidence: high

# Push protection settings
push_protection_enabled: true

# Review required for secret scanning alerts
reviewer: myorg/security-team

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Custom .gitleaks.toml configuration
      - name: Run Gitleaks with custom config
        uses: gitleaks/gitleaks-action@v2
        with:
          args: detect --config .gitleaks.toml --source . --report-path gitleaks-report.json

      - name: Upload scan results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: gitleaks-report
          path: gitleaks-report.json

[[rules]]
id = "custom-api-key"
description = "Custom API key pattern"
regex = '''(?i)(api[_-]?key|apikey)[s]*[=:][s]*['"]?([a-zA-Z0-9]{32,64})['"]?'''
tags = ["key", "api"]

[[rules]]
id = "connection-string"
description = "Database connection string"
regex = '''(?i)(db[_-]?url|database[_-]?url)[s]*[=:][s]*['"]?(postgres(ql)?://[^s'"]+)['"]?'''
tags = ["database", "connection"]

[[rules]]
id = "jwt-token"
description = "JSON Web Token"
regex = '''eyJ[a-zA-Z0-9_-]*.eyJ[a-zA-Z0-9_-]*.[a-zA-Z0-9_-]*'''
tags = ["jwt", "token"]

[allowlist]
description = "Global allowlist"
paths = [
  '''vendor/''',
  '''node_modules/''',
  '''*.test.ts''',
  '''*.spec.ts''',
]

jobs:
  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: TruffleHog scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified --json

      # Scan specific repository
      - name: Scan GitHub repo
        run: |
          trufflehog github \
            --repo=https://github.com/myorg/myrepo \
            --token=${{ secrets.GITHUB_TOKEN }} \
            --only-verified \
            --json > trufflehog-results.json

      # Scan S3 bucket
      - name: Scan S3
        run: |
          trufflehog s3 \
            --bucket=my-secrets-bucket \
            --only-verified

# Enable in repository settings or via API
# Repository > Settings > Code security and analysis > Push protection

# Via API
curl -X PUT \
  https://api.github.com/repos/myorg/myrepo \
  -H "Authorization: token ${GITHUB_TOKEN}" \
  -d '{
    "security_and_analysis": {
      "secret_scanning": {
        "status": "enabled"
      },
      "secret_scanning_push_protection": {
        "status": "enabled"
      }
    }
  }'