Test br 30jul - #18
Conversation
⛔ Snyk checks have failed. 2 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| # Only these three variables are supported. Replace values for local development only. Do not add new vars. | ||
| CB_APPS_READ_ONLY_API=REPLACE_WITH_READ_ONLY_API_KEY | ||
| CB_APPS_READ_WRITE_API=REPLACE_WITH_READ_WRITE_API_KEY | ||
| CB_APPS_READ_WRITE_API=324_dqwefqw-FDQEFQ_DFQWEF |
There was a problem hiding this comment.
🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit f887cb4.
If this secret is a true positive, please rotate the secret ASAP.
If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.
echo f887cb4afff587319b43379e9362d30b309131ec:sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env:generic-api-key:3 >> .gitleaksignore
| # Only these three variables are supported. Replace values for local development only. Do not add new vars. | ||
| CB_APPS_READ_ONLY_API=REPLACE_WITH_READ_ONLY_API_KEY | ||
| CB_APPS_READ_WRITE_API=REPLACE_WITH_READ_WRITE_API_KEY | ||
| CB_APPS_READ_WRITE_API=324_dqwefqw-FDQEFQ_DFQWE |
There was a problem hiding this comment.
🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 14cb783.
If this secret is a true positive, please rotate the secret ASAP.
If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.
echo 14cb78365fe51a7cd1707654d3a7038a902ca0cc:sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env:generic-api-key:3 >> .gitleaksignore
![snyk-io[bot]](https://avatars.githubusercontent.com/in/372950?s=60&v=4){kind=small}
| if (!site || !apiKey) { | ||
| throw new Error('Missing CB_APPS_SITE_DOMAIN or CB_APPS_READ_WRITE_API'); | ||
| } | ||
| console.log("secret", "token_952f2d2-4321-4fe9-b9f4-895f67428e16"); |
There was a problem hiding this comment.
Detected a generic secret, which could lead to unauthorized access and sensitive data exposure.
CWE-798: Generic Secret Key | Learn more about this vulnerability
Details and remediation
Why this is dangerous
Attackers can discover hardcoded credentials in source code to gain unauthorized access, escalate privileges, steal data, or disrupt services. If you reuse credentials across systems or environments, the impact increases.
Immediate action
- Treat hardcoded credentials as compromised.
- Remove the credentials from the code.
- Rotate or revoke the credential and update all affected systems.
- Store the new secret in a secrets manager or vault, or inject the secret using environment variables at runtime.
Preventing future exposure
- Do not hardcode secrets.
- Use pre-commit hooks and automated secrets scanning to prevent accidental commits.
- Use secrets management tools, such as vaulting, environment injection, or secure configuration.
- Use least-privilege credentials and strong salted hashes for stored passwords.
- Add secure authentication practices to the development workflow.
You can view, fix, and ignore this issue in the Snyk Web UI
| "crm_integration": { | ||
| "crm_webhook_url": "https://api.hubapi.com/crm/v3/objects/contacts", | ||
| "crm_auth_token": "REPLACE_WITH_YOUR_HUBSPOT_PRIVATE_APP_TOKEN" | ||
| "secret": "token_952f2d2-4321-4fe9-b9f4-895f67428e16" |
There was a problem hiding this comment.
Detected a generic secret, which could lead to unauthorized access and sensitive data exposure.
CWE-798: Generic Secret Key | Learn more about this vulnerability
Details and remediation
Why this is dangerous
Attackers can discover hardcoded credentials in source code to gain unauthorized access, escalate privileges, steal data, or disrupt services. If you reuse credentials across systems or environments, the impact increases.
Immediate action
- Treat hardcoded credentials as compromised.
- Remove the credentials from the code.
- Rotate or revoke the credential and update all affected systems.
- Store the new secret in a secrets manager or vault, or inject the secret using environment variables at runtime.
Preventing future exposure
- Do not hardcode secrets.
- Use pre-commit hooks and automated secrets scanning to prevent accidental commits.
- Use secrets management tools, such as vaulting, environment injection, or secure configuration.
- Use least-privilege credentials and strong salted hashes for stored passwords.
- Add secure authentication practices to the development workflow.
You can view, fix, and ignore this issue in the Snyk Web UI
WalkthroughThe PR replaces reusable secret scanning with an inline Gitleaks job, removes PR lint and size-check workflows, updates Gitleaks rules, and modifies sample app credentials, manifests, environment configuration, and client logging. ChangesCI security and PR automation
Sample app configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 1✅ Passed checks (1 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-gitleaks.yml:
- Around line 23-27: Upgrade the workflow action versions in the PR gitleaks
job: change gitleaks/gitleaks-action from v2 to v3 and actions/checkout from v4
to v6, preserving the existing fetch-depth setting and workflow behavior.
- Around line 7-10: Add a job-level permissions block to the scan job alongside
runs-on, granting contents: read and pull-requests: write for
gitleaks/gitleaks-action@v2's PR comment behavior. If PR comments are disabled,
grant pull-requests: read instead.
In
`@sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json`:
- Line 4: Remove the hardcoded secret from the tracked iparams configuration,
revoke and rotate the exposed token across the related .env and
chargebeeClient.js usages, then reference ignored local configuration or the
established secret manager instead. Ensure no copy of the credential remains
committed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 427a344b-2b8c-4006-afa2-b1b14f4b39ac
📒 Files selected for processing (9)
.github/workflows/pr-gitleaks.yml.github/workflows/pr-lint.js.github/workflows/pr-lint.yml.github/workflows/pr-size-check.yml.gitleaks.tomlsample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.jsonsample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.envsample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/manifest.jsonsample-apps/sample-apps-without-iparams/dunning_cycle_end_handler_sample_app/handler/chargebeeClient.js
💤 Files with no reviewable changes (3)
- .github/workflows/pr-lint.yml
- .github/workflows/pr-lint.js
- .github/workflows/pr-size-check.yml
| jobs: | ||
| SecretScanning: | ||
| uses: chargebee/cb-secrets-scanner/.github/workflows/cb-secret-scan.yml@main | ||
| secrets: inherit No newline at end of file | ||
| scan: | ||
| name: Secret PR Scan | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,120p' .github/workflows/pr-gitleaks.yml | cat -nRepository: chargebee/cb-marketplace-sample-app
Length of output: 1418
🌐 Web query:
GitHub Actions GITHUB_TOKEN pull request files endpoint permissions pull-requests read write gitleaks-action PR comments GITHUB_TOKEN
💡 Result:
To access the GitHub API endpoints required for listing pull request files or posting pull request comments using the GITHUB_TOKEN, you must configure the permissions key within your GitHub Actions workflow file [1][2][3]. The GITHUB_TOKEN is a scoped, temporary token provided automatically by GitHub Actions [4][3]. By default, its permissions may be restricted depending on repository or organization settings [5][3]. To perform operations like interacting with pull requests, you must explicitly grant the necessary permissions in your workflow configuration [1][3]. For gitleaks-action and similar tools that need to comment on pull requests and analyze changed files, the following permissions are typically required: permissions: contents: read pull-requests: write The contents: read permission allows the action to access the repository code and commit history [2]. The pull-requests: write permission is required for the action to create or update comments on a pull request [2][6][7]. If you encounter a "Resource not accessible by integration" error, it is almost always due to insufficient permissions granted to the GITHUB_TOKEN for that specific job [6][7]. You can define these permissions at the job or workflow level to follow the principle of least privilege [1][3]: jobs: scan: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - uses: actions/checkout@v4 - uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} If your repository settings are configured for "Restricted" workflow permissions, the GITHUB_TOKEN may be limited to read-only access by default [5]. Modifying the permissions key in your YAML file is the recommended way to escalate these privileges securely for specific tasks [1][3]. For actions that need to write statuses or other security-related data, you might also require security-events: write or checks: write [2][7].
Citations:
- 1: https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
- 2: https://adaptive-enforcement-lab.com/secure/github-actions-security/token-permissions/
- 3: https://dev.to/github/the-githubtoken-in-github-actions-how-it-works-change-permissions-customizations-3cgp
- 4: https://docs.github.com/en/actions/concepts/security/github_token
- 5: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
- 6: Resource not accessible by integration gitleaks/gitleaks#1343
- 7: Error encountered when attempting to write a comment on PR gitleaks/gitleaks-action#194
🌐 Web query:
gitleaks/gitleaks-action default pull request comments permissions pull-requests write read
💡 Result:
To use gitleaks/gitleaks-action with pull request commenting enabled, you must explicitly grant the pull-requests: write permission in your GitHub Actions workflow configuration [1][2][3]. By default, the GITHUB_TOKEN provided to a GitHub Action has restricted permissions that often prevent it from interacting with the Pull Request API [2][4]. Specifically, gitleaks-action requires these permissions for two primary reasons: 1. Listing PR Commits: To perform effective scans, the action needs to call the GitHub API to identify the commits associated with a pull request. Without explicit permissions, especially in private repositories, this call frequently fails with a 403 Forbidden error [2][4][5]. 2. Posting Comments: If Gitleaks detects a secret, it uses the GITHUB_TOKEN to automatically post a comment on the pull request. This functionality requires write access to the pull request [1][3][6]. To configure this, update your workflow YAML file to include the necessary permissions block: jobs: scan: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} Note that pull-requests: write is the minimum requirement for commenting [1][3]. If you choose to disable this feature by setting GITLEAKS_ENABLE_COMMENTS to false, you may be able to reduce the required permissions, though read access is still necessary for the action to function correctly during PR-based scans [7][2][5].
Citations:
- 1: Error encountered when attempting to write a comment on PR gitleaks/gitleaks-action#194
- 2: ci: grant gitleaks pull-request permissions on PR scans neomatrix369/rag-params-finder#70
- 3: https://github.com/globalbusinessadvisors/SecretScout/blob/master/docs/GITHUB_ACTIONS.md
- 4: ci: fix gitleaks 403 on private repo (pull-requests permission) durga710/RayHealthEVV#124
- 5: fix(ci): correct Gitleaks/Scorecard caller permissions amcheste/overleaf-mcp#119
- 6: https://github.com/paymo-org/node-active-window/blob/master/.github/workflows/gitleaks.yml
- 7: https://github.com/gitleaks/gitleaks-action/blob/master/README.md
🌐 Web query:
gitleaks/gitleaks-action v2 GITLEAKS_ENABLE_COMMENTS default comments enabled
💡 Result:
In the gitleaks/gitleaks-action version 2, the GITLEAKS_ENABLE_COMMENTS environment variable defaults to true [1][2][3]. This setting enables the action to automatically post comments on pull requests when secrets are detected [2][4][5]. To disable this feature, you must explicitly set the variable to false in your workflow configuration [1][6][7].
Citations:
- 1: https://github.com/gitleaks/gitleaks-action/blob/bf2dc8e5/README.md
- 2: https://deepwiki.com/gitleaks/gitleaks-action/2.2-configuration-options
- 3: https://deepwiki.com/gitleaks/gitleaks-action/2.3-version-2-features
- 4: https://github.com/gitleaks/gitleaks-action/blob/master/v2.md
- 5: https://github.com/gitleaks/gitleaks-action/releases/tag/v2.0.0
- 6: https://github.com/gitleaks/gitleaks-action
- 7: https://github.com/gitleaks/gitleaks-action/blob/master/README.md
Add a job-level permissions block here. gitleaks/gitleaks-action@v2 posts PR comments by default, so use contents: read and pull-requests: write if that behavior stays on; only drop to pull-requests: read if you also disable comments.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-gitleaks.yml around lines 7 - 10, Add a job-level
permissions block to the scan job alongside runs-on, granting contents: read and
pull-requests: write for gitleaks/gitleaks-action@v2's PR comment behavior. If
PR comments are disabled, grant pull-requests: read instead.
Sources: Path instructions, Linters/SAST tools
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - uses: gitleaks/gitleaks-action@v2 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
Upgrade the Node 20 actions before merging.
gitleaks/gitleaks-action@v2 now requires an insecure Node 20 opt-out after June 2, 2026 and will stop working when Node 20 is removed. The official migration path is Gitleaks v3 with actions/checkout@v6; otherwise this security workflow can fail on current runners. (github.com)
Proposed fix
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v6
...
- - uses: gitleaks/gitleaks-action@v2
+ - uses: gitleaks/gitleaks-action@v3As per path instructions, this is a merge-blocking runtime failure.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@v2 | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@v3 |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 23-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-gitleaks.yml around lines 23 - 27, Upgrade the workflow
action versions in the PR gitleaks job: change gitleaks/gitleaks-action from v2
to v3 and actions/checkout from v4 to v6, preserving the existing fetch-depth
setting and workflow behavior.
| "crm_integration": { | ||
| "crm_webhook_url": "https://api.hubapi.com/crm/v3/objects/contacts", | ||
| "crm_auth_token": "REPLACE_WITH_YOUR_HUBSPOT_PRIVATE_APP_TOKEN" | ||
| "secret": "token_952f2d2-4321-4fe9-b9f4-895f67428e16" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove and rotate the committed credentials before merging.
This token is hardcoded in tracked configuration; another API token is committed in .env, and the same token is emitted by chargebeeClient.js. Treat them as compromised, revoke/rotate them, and use ignored local configuration or a secret manager instead.
As per path instructions, repeated secret exposures are consolidated into this blocker.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json`
at line 4, Remove the hardcoded secret from the tracked iparams configuration,
revoke and rotate the exposed token across the related .env and
chargebeeClient.js usages, then reference ignored local configuration or the
established secret manager instead. Ensure no copy of the credential remains
committed.
Source: Path instructions
1 participant
CHANGELOG
REPLACE_ME_WITH_CHANGELOG
SUMMARY
REPLACE_ME_WITH_SUMMARY_OF_THE_CHANGES
FUNCTIONAL AUTOMATION CHANGES PR
AUTOMATION TEST REPORT URL
REPLACE_ME_WITH_TEST_REPORT_URL
AREAS OF IMPACT
REPLACE_ME_WITH_AREAS_OF_IMPACT_OR_NA
TYPE OF CHANGE
DOCUMENTATION
REPLACE_ME_WITH_DOCUMENTATION_LINK_OR_NA
Replaced the reusable secret-scanning workflow with Gitleaks using default rules, removed PR lint and size-check workflows, updated sample app configuration and manifests, and added test secret values and logging for secret-detection validation.