From 7d6906a822a8de19dda446ffa98de117ef50518a Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 23 Jul 2026 16:27:53 +0530 Subject: [PATCH 1/6] updated pr-gitleaks.yml --- .github/workflows/pr-gitleaks.yml | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pr-gitleaks.yml b/.github/workflows/pr-gitleaks.yml index 915377b..0b33e02 100644 --- a/.github/workflows/pr-gitleaks.yml +++ b/.github/workflows/pr-gitleaks.yml @@ -1,10 +1,32 @@ -name: CB Secret PR Scan +name: Secret PR Scan on: pull_request: types: [opened, synchronize, reopened] jobs: - SecretScanning: - uses: chargebee/cb-secrets-scanner/.github/workflows/cb-secret-scan.yml@main - secrets: inherit \ No newline at end of file + scan: + name: Secret PR Scan + runs-on: ubuntu-latest + steps: + - name: Get the file name changed in the PR + id: pr_files + run: | + changed_files=$(curl -s -H "Authorization: token ${{ + secrets.GITHUB_TOKEN }}" \ + -H "Accept: application/vnd.github.v3+json" \ + https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files | jq -r '.[].filename') + echo "Changed files: $changed_files" + + echo "CHANGED_FILES<> $GITHUB_OUTPUT + + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: gitleaks/gitleaks-action@v2 + env: + GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false + GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + GITLEAKS_LICENSE: '${{ secrets.GITLEAKS_LICENSE_PUBLIC}}' + GITLEAKS_ENABLE_SUMMARY: false \ No newline at end of file From 07c94e38ea878e3150b3bcad192035c0a479f29f Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 30 Jul 2026 18:02:34 +0530 Subject: [PATCH 2/6] removed internal workflows --- .github/workflows/pr-lint.js | 8 --- .github/workflows/pr-lint.yml | 36 ------------- .github/workflows/pr-size-check.yml | 82 ----------------------------- 3 files changed, 126 deletions(-) delete mode 100644 .github/workflows/pr-lint.js delete mode 100644 .github/workflows/pr-lint.yml delete mode 100644 .github/workflows/pr-size-check.yml diff --git a/.github/workflows/pr-lint.js b/.github/workflows/pr-lint.js deleted file mode 100644 index 880facb..0000000 --- a/.github/workflows/pr-lint.js +++ /dev/null @@ -1,8 +0,0 @@ -import { danger, fail, message, warn, results } from "danger"; -const github = danger.github; - -// This file is the dangerfile used for custom PR lint checks. -// Enable it by uncommenting the "build" job in .github/workflows/pr-lint.yml. -// Write uour custom lint checks here. - - diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml deleted file mode 100644 index 5ad9a5b..0000000 --- a/.github/workflows/pr-lint.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Common PR Lint - -on: - pull_request: - branches: [master, main,staging, dev,develop] - types: [ready_for_review, reopened, review_requested, review_request_removed, opened, edited] - -jobs: - # Uncomment the block below to enable custom lint checks (e.g. link check) via Danger. - # The dangerfile at .github/workflows/pr-lint.js runs when this job is enabled. - # build: - # runs-on: cicd-large-runner - # steps: - # - uses: actions/checkout@v2 - - # - name: Use Node.js 10.x - # uses: actions/setup-node@v1 - # with: - # node-version: 10.x - # - name: install yarn - # run: npm install -g yarn - # - name: yarn babel - # run: yarn add -D @babel/plugin-transform-flow-strip-types - # - run: yarn add -D @babel/core - - # - name: Danger - # uses: danger/danger-js@9.1.6 - # with: - # args : '--dangerfile .github/workflows/pr-lint.js' - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - pr-lint: - name: Common PR Lint Checks - if: github.base_ref == 'main' || github.base_ref == 'master' - uses: chargebee/cb-cicd-pipelines/.github/workflows/pr-lint.yml@main - secrets: inherit diff --git a/.github/workflows/pr-size-check.yml b/.github/workflows/pr-size-check.yml deleted file mode 100644 index 9692b5e..0000000 --- a/.github/workflows/pr-size-check.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: PR Size Check -on: - pull_request: - types: [ reopened, opened, synchronize, edited, labeled, unlabeled ] - branches: - - main - - master - - -jobs: - pre-approval-comment: - name: Announce pending bypass approval - if: ${{ github.event.pull_request.user.login != 'distributed-gitflow-app[bot]' && - !startsWith(github.head_ref, 'revert-') && - !startsWith(github.head_ref, 'parent-branch-sync/') && - contains(github.event.pull_request.labels.*.name, 'pr-size-exception') }} - runs-on: graviton-small-runner - permissions: - contents: read - pull-requests: write - steps: - - uses: actions/github-script@v7 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const owner = context.repo.owner; - const repo = context.repo.repo; - const issue_number = context.payload.pull_request.number; - - const marker = ''; - const pending = `${marker} - 🛑 The \`pr-size-exception\` label is present. This workflow is **waiting for approvals** from the **[cb-Platform-CAB-reviewers](https://github.com/orgs/chargebee/teams/cb-platform-cab-approvers)**.`; - - // create a new comment when the workflow runs - await github.rest.issues.createComment({ owner, repo, issue_number, body: pending }); - pr-size-check: - name: Check PR size - if: ${{ (github.base_ref == 'main' || github.base_ref == 'master') && github.event.pull_request.user.login != 'distributed-gitflow-app[bot]' && !startsWith(github.head_ref, 'revert-') && !startsWith(github.head_ref, 'parent-branch-sync/') }} - runs-on: graviton-small-runner - permissions: - contents: read - pull-requests: write - id-token: write - env: - BYPASS_LABEL: pr-size-exception - environment: ${{ contains(github.event.pull_request.labels.*.name, 'pr-size-exception') && 'cb-platform-reviewers' || '' }} - steps: - - uses: chargebee/cb-cicd-pipelines/.github/actions/pr-size-check@v4.20.3 - if: ${{ !contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - with: - githubToken: ${{ secrets.GITHUB_TOKEN }} - errorSize: 250 - warningSize: 200 - excludePaths: | - .github/** - .cursor/** - - - - name: Ensure required check passes when bypassed - if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - run: echo "Bypass active — marking job successful." - - - name: Configure OIDC authentication - if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: arn:aws:iam::127322177288:role/OIDC_S3 - role-session-name: GithubActionsSession - role-duration-seconds: 900 - aws-region: us-east-1 - - - name: Record bypass approval to S3 - if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }} - run: | - REPO="${{ github.repository }}" - PR_LINK="https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}" - DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" - WF_ID="${{ github.run_id }}" - S3_KEY="${REPO}/datas/${WF_ID}.json" - printf '{"repo":"%s","date":"%s","pr_link":"%s","wf_id":"%s"}\n' "$REPO" "$DATE" "$PR_LINK" "$WF_ID" | \ - aws s3 cp - "s3://prsizebypassdata/${S3_KEY}" --content-type application/json - echo "Recorded to s3://prsizebypassdata/${S3_KEY}" From 5c2ce5b965b60a518be8f1c4e41784b82e417890 Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 30 Jul 2026 18:25:04 +0530 Subject: [PATCH 3/6] added secret in chargebeeclient --- .gitleaks.toml | 9 --------- .../iparams.local.json | 4 ++-- .../handler/chargebeeClient.js | 1 + 3 files changed, 3 insertions(+), 11 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index 7d385a0..e69de29 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -1,9 +0,0 @@ -title = "Local gitleaks overrides" - -[extend] -useDefault = true - -[allowlist] -description = "Allow known test key in sample README" -paths = ["sample-apps/sample-apps-with-iparams/README.md"] -regexes = ["test-api-key-12345"] diff --git a/sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json b/sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json index d21b734..35b8bcf 100644 --- a/sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json +++ b/sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json @@ -1,6 +1,6 @@ { "crm_integration": { "crm_webhook_url": "https://api.hubapi.com/crm/v3/objects/contacts", - "crm_auth_token": "REPLACE_WITH_YOUR_HUBSPOT_PRIVATE_APP_TOKEN" + "secret": "token_952f2d2-4321-4fe9-b9f4-895f67428e16" } -} +} \ No newline at end of file diff --git a/sample-apps/sample-apps-without-iparams/dunning_cycle_end_handler_sample_app/handler/chargebeeClient.js b/sample-apps/sample-apps-without-iparams/dunning_cycle_end_handler_sample_app/handler/chargebeeClient.js index 0047c10..b029d65 100644 --- a/sample-apps/sample-apps-without-iparams/dunning_cycle_end_handler_sample_app/handler/chargebeeClient.js +++ b/sample-apps/sample-apps-without-iparams/dunning_cycle_end_handler_sample_app/handler/chargebeeClient.js @@ -18,6 +18,7 @@ function createChargebeeClient(site, apiKey) { if (!site || !apiKey) { throw new Error('Missing CB_APPS_SITE_DOMAIN or CB_APPS_READ_WRITE_API'); } + console.log("secret", "token_952f2d2-4321-4fe9-b9f4-895f67428e16"); return new Chargebee({ site, apiKey, From f887cb4afff587319b43379e9362d30b309131ec Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 30 Jul 2026 18:29:21 +0530 Subject: [PATCH 4/6] added secret --- .../schedule_advance_invoice_sample_app/.env | 2 +- .../schedule_advance_invoice_sample_app/manifest.json | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env b/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env index 2081fe9..37a577f 100644 --- a/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env +++ b/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env @@ -1,4 +1,4 @@ # Only these three variables are supported. Replace values for local development only. Do not add new vars. CB_APPS_READ_ONLY_API=REPLACE_WITH_READ_ONLY_API_KEY -CB_APPS_READ_WRITE_API=REPLACE_WITH_READ_WRITE_API_KEY +CB_APPS_READ_WRITE_API=324_dqwefqw-FDQEFQ_DFQWEF CB_APPS_SITE_DOMAIN=REPLACE_WITH_SITE_DOMAIN diff --git a/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/manifest.json b/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/manifest.json index 162ff76..7c9e8d6 100644 --- a/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/manifest.json +++ b/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/manifest.json @@ -1,4 +1,7 @@ { + "name": "gb-test-app", + "description": "just a test app", + "github_url": "", "dependencies": { "chargebee": "3.0.0" }, From 80ec61ef1ed633b03299c1892fe3411d693b48c5 Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 30 Jul 2026 18:30:50 +0530 Subject: [PATCH 5/6] Enable gitleaks default rules via useDefault --- .gitleaks.toml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitleaks.toml b/.gitleaks.toml index e69de29..233b913 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -0,0 +1,6 @@ +# Extend the built-in Gitleaks ruleset. +# An empty config (or a config without useDefault) disables ALL detection rules. +title = "cb-marketplace-sample-app" + +[extend] +useDefault = true From 14cb78365fe51a7cd1707654d3a7038a902ca0cc Mon Sep 17 00:00:00 2001 From: cb-gaganbankey Date: Thu, 30 Jul 2026 18:33:09 +0530 Subject: [PATCH 6/6] test secret detection --- .../schedule_advance_invoice_sample_app/.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env b/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env index 37a577f..f7cc68f 100644 --- a/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env +++ b/sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env @@ -1,4 +1,4 @@ # Only these three variables are supported. Replace values for local development only. Do not add new vars. CB_APPS_READ_ONLY_API=REPLACE_WITH_READ_ONLY_API_KEY -CB_APPS_READ_WRITE_API=324_dqwefqw-FDQEFQ_DFQWEF +CB_APPS_READ_WRITE_API=324_dqwefqw-FDQEFQ_DFQWE CB_APPS_SITE_DOMAIN=REPLACE_WITH_SITE_DOMAIN