diff --git a/.github/workflows/secrets-scan-daily.yml b/.github/workflows/secrets-scan-daily.yml deleted file mode 100644 index 6a6031be9..000000000 --- a/.github/workflows/secrets-scan-daily.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Daily Secrets Detection - -on: - schedule: - # Run daily at 9:00 AM UTC - - cron: '0 9 * * *' - workflow_dispatch: # Allow manual triggering - -permissions: read-all - -jobs: - daily-secrets-scan: - name: Daily Secrets Scan - runs-on: ubuntu-latest - permissions: - contents: read - id-token: write - env: - CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection" - CHAINLOOP_PROJECT_NAME: "chainloop" - - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - persist-credentials: false - - - name: Install Chainloop - run: | - curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s - - - name: Initialize Attestation - run: | - chainloop attestation init --org chainloop --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME} - - - name: Install Gitleaks - run: | - wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz - mkdir -p /tmp/gitleaks-install - tar -xzf gitleaks_8.30.0_linux_x64.tar.gz -C /tmp/gitleaks-install - sudo install /tmp/gitleaks-install/gitleaks /usr/local/bin/ - rm -rf /tmp/gitleaks-install gitleaks_8.30.0_linux_x64.tar.gz - gitleaks version - - - name: Run Gitleaks Scan - run: | - gitleaks dir . \ - --report-format json \ - --report-path gitleaks-report.json \ - --config .github/workflows/utils/.gitleaks.toml \ - || true - - - name: Add Gitleaks Report to Attestation - run: | - chainloop attestation add \ - --name secret-report \ - --value gitleaks-report.json \ - --kind GITLEAKS_JSON - - - name: Finish and Push Attestation - if: ${{ success() }} - run: | - chainloop attestation push - - - name: Mark attestation as failed - if: ${{ failure() }} - run: | - chainloop attestation reset - - - name: Mark attestation as cancelled - if: ${{ cancelled() }} - run: | - chainloop attestation reset --trigger cancellation