diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml index bcdb1c0..0b33e02 100644 --- a/.github/workflows/secrets-scan.yml +++ b/.github/workflows/secrets-scan.yml @@ -1,10 +1,32 @@ -name: CB Secret PR Scan +name: Secret PR Scan on: pull_request: types: [opened, synchronize, reopened] jobs: - SecretScanning: - uses: chargebee/cb-secrets-scanner/.github/workflows/cb-secret-scan.yml@main - secrets: inherit + scan: + name: Secret PR Scan + runs-on: ubuntu-latest + steps: + - name: Get the file name changed in the PR + id: pr_files + run: | + changed_files=$(curl -s -H "Authorization: token ${{ + secrets.GITHUB_TOKEN }}" \ + -H "Accept: application/vnd.github.v3+json" \ + https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files | jq -r '.[].filename') + echo "Changed files: $changed_files" + + echo "CHANGED_FILES<> $GITHUB_OUTPUT + + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: gitleaks/gitleaks-action@v2 + env: + GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false + GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + GITLEAKS_LICENSE: '${{ secrets.GITLEAKS_LICENSE_PUBLIC}}' + GITLEAKS_ENABLE_SUMMARY: false \ No newline at end of file diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..1d1f91f --- /dev/null +++ b/LICENSE @@ -0,0 +1,24 @@ +The MIT License + +Copyright (c) 2011-2026 Chargebee, Inc. + +Permission is hereby granted, free of charge, to any person +obtaining a copy of this software and associated documentation +files (the "Software"), to deal in the Software without +restriction, including without limitation the rights to use, +copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES +OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT +HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..4edc95e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,8 @@ +# Security Policy + +At Chargebee, we take data integrity and security very seriously. Due to the nature of the product and service we provide, we are committed to working with individuals to stay updated on the latest security techniques and fix any security weakness in our application or infrastructure reported to us responsibly by external parties. + +https://www.chargebee.com/security/responsible-disclosure-policy/ + +## Reporting a vulnerability +Reach out to us at security@chargebee.com. Please do not open GitHub issues or pull requests as this makes the problem immediately visible to everyone, including malicious actors. Chargebee's security team will triage your report and respond according to its impact. \ No newline at end of file diff --git a/cyberHygiene.md b/cyberHygiene.md deleted file mode 100644 index 237848e..0000000 --- a/cyberHygiene.md +++ /dev/null @@ -1,36 +0,0 @@ -This repository was created from a starter template that includes essential configurations to help you ensure your codebase always remains secure by scanning for sensitive information such as API keys, access tokens, and other secrets hardcoded in the codebase. - -## Starter kit files - -### 1. **GitHub Actions Secrets Scanning Workflow** - -- **Path**: `.github/workflows/secrets-scan.yml` -- **What It Is**: A GitHub Actions workflow that automatically scans for secrets in the files modified each time you open a pull request. -- **Why It's Here**: To detect hardcoded secrets in your codebase and prevent it from being exposed. If secrets are found, the workflow will fail, and you'll be notified of the findings so you can take action. - -### 2. **Pre-commit Configuration File** - -- **Path**: `.pre-commit-config.yaml` -- **What It Is**: This file configures pre-commit hooks to run checks on your code before every commit. -- **Why It's Here**: It ensures that secrets are scanned locally before any code is committed, preventing you from accidentally pushing secrets to your repository. - -## Actions to be performed - -**THESE FILES ARE INTEGRAL IN MAINTAINING A SECURE CODEBASE, DO NOT DELETE OR MODIFY THEM** - -**Configure Pre-commit Hooks Locally**: - - - Install `pre-commit` on your machine: - ```bash - brew install pre-commit - ``` - - Install the pre-commit hooks in your repository: - ```bash - cd /path/to/your/repo - pre-commit install - ``` - - Integrate Pre-commit in the build process: - > To ensure that git hooks are consistently configured, you must add the `pre-commit install` step to your build script. - > This is **mandatory** for all repositories. Please refer to [Hardcoded secrets prevention via Git pre-commit hooks](https://mychargebee.atlassian.net/wiki/spaces/ECS/pages/3335618745/Hardcoded+secrets+prevention+via+Git+pre-commit+hooks) for a detailed walkthrough. - -Feel free to contact `#ask-security` if you face any issues. \ No newline at end of file