Repository navigation
CI: real-tool smoke for gitleaks, trufflehog, checkov and kube-score - #2364
Merged
Merged
Conversation
Extends the real-hub CI job with gitleaks 8.30.1, trufflehog 3.99.9 (offline, no verification), checkov 3.4.5 and kube-score 1.20.0, each run through review_checks.sh on one fictional canary; the job fails unless each tool ran and reported its expected rule on that file. The token-shaped canary is joined at runtime so no source line matches the privacy gate. Binaries are pinned by sha256 from each upstream checksums file; checkov is added to the hash-locked requirements (re-resolved: boto3, botocore, s3transfer, networkx and packaging take checkov's older pins). Tests: 20/20 real-tool canaries in CI; locally gitleaks, trufflehog, checkov, kube-score pass (gosec fails only on the sandbox go cache) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
checkov depends on bc-detect-secrets, which installs the same detect_secrets module and CLI as upstream detect-secrets 1.5.0. In the shared venv it shadowed the upstream tool, so the real-hub detect-secrets canary lost its Basic Auth Credentials row. checkov and its transitive pins move to scripts/real-hub-requirements-checkov.txt, installed with --require-hashes --only-binary=:all: into a separate venv; only its checkov binary is symlinked onto PATH. scripts/real-hub-requirements.txt returns to origin/main (boto3, networkx, packaging prior pins). The detect-secrets install step now asserts `detect-secrets --version` prints 1.5.0. Pins derived with uv pip compile (linux x86_64, Python 3.13). The real-hub job itself runs only in CI. Tests: 5/5 local gates (bash -n, actionlint, size, size-ratchet, privacy) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extends the real-hub CI job to four more scanners routed through review_checks.sh: gitleaks 8.30.1, trufflehog 3.99.9 (no verification, offline), checkov 3.4.5 and kube-score 1.20.0. Binaries are checked against upstream sha256; checkov joins the hash-locked requirements file. Each tool runs on one fictional canary file, and the job fails unless it ran and reported its expected rule there. Secret canaries are built at runtime so no fictional credential matches the privacy gate.
All four canaries passed locally on macOS; this PR's CI run is the first run of the pinned Linux binaries. semgrep, trivy, cppcheck and njsscan were skipped for now.
Tests: canaries run in CI; actionlint, bash -n, the size gate, the size ratchet and the privacy gate pass locally.
🤖 Generated with Claude Code