SK-3018-gitleaks-detection-fix-added-automated-script-to-fix-generate… - #346
Conversation
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved critical and moderate issues affect secret detection, failure handling, and staging safety.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (3)
What changed in this PR
Adds automated gitleaks redaction and verification for generated code, integrating it into pre-commit workflows.
Changes:
- Adds redaction and TypeScript verification.
- Registers npm scripts for redaction and hook setup.
- Adds two-tier pre-commit secret scanning.
| File | Summary | Findings |
|---|---|---|
scripts/patch-generated-secrets.js |
Detects, redacts, compiles, and verifies generated code. | Line 248 — Moderate (3 votes): Final-scan failures can leave overwritten files un restored and stage unverified edits. |
package.json |
Registers redaction and hook setup scripts. | None recorded. |
.githooks/pre-commit |
Runs redaction and staged gitleaks scanning. | Line 48 — Critical (1 vote): Missing gitleaks allows commits containing secrets, and CI does not block findings. Line 46 — Moderate (2 votes): Unconditionally stages all working-tree changes, including unrelated or incomplete changes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if ! command -v gitleaks >/dev/null 2>&1; then | ||
| echo "[leak-guard] tier 2 skipped: 'gitleaks' binary not found locally." | ||
| echo "[leak-guard] CI will still scan this PR - install gitleaks locally to catch issues before pushing." | ||
| exit 0 |
| # practice: src/_generated_ is machine-owned (Fern-generated, never hand | ||
| # edited), so there's no legitimate "leave part of it unstaged" case to worry | ||
| # about disturbing. | ||
| git add -- "src/ _generated_" |
| const remaining = runGitleaksDetect( | ||
| GENERATED_CODE_PREFIX.replace(/\/$/, ""), | ||
| repoRoot, | ||
| ); |
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
No description provided.