ci(screenshots): scan screenshots & manifest for leaked secrets - #368
Open
yeongseon wants to merge 1 commit into
Open
ci(screenshots): scan screenshots & manifest for leaked secrets#368yeongseon wants to merge 1 commit into
yeongseon wants to merge 1 commit into
Conversation
…ecrets Ports the openapi secret scanner to this repository's screenshot staleness checker so a screenshot (or its manifest) that captures an Azure subscription id, storage/SAS key, function code= key, SAS signature, or bearer token hard-fails CI before it can be committed. Matched secrets are redacted in output so the scanner never re-leaks them into CI logs. Reviewed false positives can be exempted via a manifest-level 'secret_scan_allow' list. Closes #365
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Closes #365. Mirrors the openapi hardening (yeongseon/azure-functions-openapi-python#517). Documentation screenshots and their manifest can accidentally capture live Azure secrets — subscription ids, storage/SAS keys, function
code=keys, SAS signatures, or bearer tokens — which are effectively leaked once committed. The screenshot staleness checker already gates PRs, so it is the natural place to also gate secret leakage.What changed
scripts/check_screenshots.py: added a narrow, high-signal secret scanner (_SECRET_PATTERNS,_scan_text_for_secrets,_scan_secrets) wired into_check()as a hard failure. Scans the manifest text and every committed screenshot's bytes. Matched secrets are redacted in output (never echoed to CI logs). Reviewed false positives can be exempted via a manifest-levelsecret_scan_allowlist. The repo's empty-manifest (screenshots: []) allowance is preserved.tests/test_screenshot_manifest.py: added regression tests for detection, non-echo redaction, and the allowlist exemption.Verification
make test→ 336 passed (coverage gate met)make lint→ All checks passedmake typecheck→ no issues in 32 files