From 7d6906a822a8de19dda446ffa98de117ef50518a Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 23 Jul 2026 16:27:53 +0530 Subject: [PATCH 1/2] updated pr-gitleaks.yml --- .github/workflows/pr-gitleaks.yml | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pr-gitleaks.yml b/.github/workflows/pr-gitleaks.yml index 915377b..0b33e02 100644 --- a/.github/workflows/pr-gitleaks.yml +++ b/.github/workflows/pr-gitleaks.yml @@ -1,10 +1,32 @@ -name: CB Secret PR Scan +name: Secret PR Scan on: pull_request: types: [opened, synchronize, reopened] jobs: - SecretScanning: - uses: chargebee/cb-secrets-scanner/.github/workflows/cb-secret-scan.yml@main - secrets: inherit \ No newline at end of file + scan: + name: Secret PR Scan + runs-on: ubuntu-latest + steps: + - name: Get the file name changed in the PR + id: pr_files + run: | + changed_files=$(curl -s -H "Authorization: token ${{ + secrets.GITHUB_TOKEN }}" \ + -H "Accept: application/vnd.github.v3+json" \ + https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files | jq -r '.[].filename') + echo "Changed files: $changed_files" + + echo "CHANGED_FILES<> $GITHUB_OUTPUT + + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: gitleaks/gitleaks-action@v2 + env: + GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false + GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + GITLEAKS_LICENSE: '${{ secrets.GITLEAKS_LICENSE_PUBLIC}}' + GITLEAKS_ENABLE_SUMMARY: false \ No newline at end of file From 07c94e38ea878e3150b3bcad192035c0a479f29f Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 30 Jul 2026 18:02:34 +0530 Subject: [PATCH 2/2] removed internal workflows --- .github/workflows/pr-lint.js | 8 --- .github/workflows/pr-lint.yml | 36 ------------- .github/workflows/pr-size-check.yml | 82 ----------------------------- 3 files changed, 126 deletions(-) delete mode 100644 .github/workflows/pr-lint.js delete mode 100644 .github/workflows/pr-lint.yml delete mode 100644 .github/workflows/pr-size-check.yml diff --git a/.github/workflows/pr-lint.js b/.github/workflows/pr-lint.js deleted file mode 100644 index 880facb..0000000 --- a/.github/workflows/pr-lint.js +++ /dev/null @@ -1,8 +0,0 @@ -import { danger, fail, message, warn, results } from "danger"; -const github = danger.github; - -// This file is the dangerfile used for custom PR lint checks. -// Enable it by uncommenting the "build" job in .github/workflows/pr-lint.yml. -// Write uour custom lint checks here. - - diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml deleted file mode 100644 index 5ad9a5b..0000000 --- a/.github/workflows/pr-lint.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Common PR Lint - -on: - pull_request: - branches: [master, main,staging, dev,develop] - types: [ready_for_review, reopened, review_requested, review_request_removed, opened, edited] - -jobs: - # Uncomment the block below to enable custom lint checks (e.g. link check) via Danger. - # The dangerfile at .github/workflows/pr-lint.js runs when this job is enabled. - # build: - # runs-on: cicd-large-runner - # steps: - # - uses: actions/checkout@v2 - - # - name: Use Node.js 10.x - # uses: actions/setup-node@v1 - # with: - # node-version: 10.x - # - name: install yarn - # run: npm install -g yarn - # - name: yarn babel - # run: yarn add -D @babel/plugin-transform-flow-strip-types - # - run: yarn add -D @babel/core - - # - name: Danger - # uses: danger/danger-js@9.1.6 - # with: - # args : '--dangerfile .github/workflows/pr-lint.js' - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - pr-lint: - name: Common PR Lint Checks - if: github.base_ref == 'main' || github.base_ref == 'master' - uses: chargebee/cb-cicd-pipelines/.github/workflows/pr-lint.yml@main - secrets: inherit diff --git a/.github/workflows/pr-size-check.yml b/.github/workflows/pr-size-check.yml deleted file mode 100644 index 9692b5e..0000000 --- a/.github/workflows/pr-size-check.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: PR Size Check -on: - pull_request: - types: [ reopened, opened, synchronize, edited, labeled, unlabeled ] - branches: - - main - - master - - -jobs: - pre-approval-comment: - name: Announce pending bypass approval - if: ${{ github.event.pull_request.user.login != 'distributed-gitflow-app[bot]' && - !startsWith(github.head_ref, 'revert-') && - !startsWith(github.head_ref, 'parent-branch-sync/') && - contains(github.event.pull_request.labels.*.name, 'pr-size-exception') }} - runs-on: graviton-small-runner - permissions: - contents: read - pull-requests: write - steps: - - uses: actions/github-script@v7 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const owner = context.repo.owner; - const repo = context.repo.repo; - const issue_number = context.payload.pull_request.number; - - const marker = ''; - const pending = `${marker} - 🛑 The \`pr-size-exception\` label is present. This workflow is **waiting for approvals** from the **[cb-Platform-CAB-reviewers](https://github.com/orgs/chargebee/teams/cb-platform-cab-approvers)**.`; - - // create a new comment when the workflow runs - await github.rest.issues.createComment({ owner, repo, issue_number, body: pending }); - pr-size-check: - name: Check PR size - if: ${{ (github.base_ref == 'main' || github.base_ref == 'master') && github.event.pull_request.user.login != 'distributed-gitflow-app[bot]' && !startsWith(github.head_ref, 'revert-') && !startsWith(github.head_ref, 'parent-branch-sync/') }} - runs-on: graviton-small-runner - permissions: - contents: read - pull-requests: write - id-token: write - env: - BYPASS_LABEL: pr-size-exception - environment: ${{ contains(github.event.pull_request.labels.*.name, 'pr-size-exception') && 'cb-platform-reviewers' || '' }} - steps: - - uses: chargebee/cb-cicd-pipelines/.github/actions/pr-size-check@v4.20.3 - if: ${{ !contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - with: - githubToken: ${{ secrets.GITHUB_TOKEN }} - errorSize: 250 - warningSize: 200 - excludePaths: | - .github/** - .cursor/** - - - - name: Ensure required check passes when bypassed - if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - run: echo "Bypass active — marking job successful." - - - name: Configure OIDC authentication - if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: arn:aws:iam::127322177288:role/OIDC_S3 - role-session-name: GithubActionsSession - role-duration-seconds: 900 - aws-region: us-east-1 - - - name: Record bypass approval to S3 - if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - run: | - REPO="${{ github.repository }}" - PR_LINK="https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}" - DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" - WF_ID="${{ github.run_id }}" - S3_KEY="${REPO}/datas/${WF_ID}.json" - printf '{"repo":"%s","date":"%s","pr_link":"%s","wf_id":"%s"}\n' "$REPO" "$DATE" "$PR_LINK" "$WF_ID" | \ - aws s3 cp - "s3://prsizebypassdata/${S3_KEY}" --content-type application/json - echo "Recorded to s3://prsizebypassdata/${S3_KEY}"