Skip to content

docs: document Gitleaks CI scanner (#2067) #2075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
codeforester wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −2
Open

docs: document Gitleaks CI scanner (#2067) #2075

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions docs/ci-supply-chain-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,15 +34,18 @@ this policy if the rule changes.

2. Replace the workflow SHAs with the resolved commits and keep the
`base-bash-libs` checkout pinned to the commit Base CI should test against.
3. Run:
3. When updating Gitleaks, update `GITLEAKS_VERSION`, its release artifact URL,
and the matching `GITLEAKS_LINUX_X64_SHA256` value together. Verify the
checksum before allowing the security job to use the new binary.
4. Run:

```bash
BASE_CLI_SOURCE_DIR=../base-cli/lib/python \
PYTHONPATH=../base-cli/lib/python:lib/python:cli/python \
python -m pytest cli/python/base_setup/tests/test_ci_supply_chain_policy.py -q
```

4. Let pull request CI run the pinned workflows before merging.
5. Let pull request CI run the pinned workflows before merging.

## Python Dependencies

Expand Down Expand Up @@ -75,3 +78,4 @@ The security job must keep these checks:
- `pip-audit` over `requirements-dev.txt`
- ShellCheck errors over tracked shell entry points and scripts
- ShellCheck warnings as non-blocking signal
- Checksum-pinned Gitleaks over committed history through `tests/scan-secrets.sh`
Loading