Skip to content

Commit 2e8d819

Browse files
ceilf6ceilf6
committed
feat: 用 gitguardian CI 对 API Key 保护
1 parent e066f4b commit 2e8d819

3 files changed

Lines changed: 189 additions & 0 deletions

File tree

‎.github/workflows/gitguardian.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: GitGuardian scan
2+
3+
on:
4+
push:
5+
branches: [develop]
6+
pull_request:
7+
branches: [develop]
8+
9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: gitguardian-${{ github.event.pull_request.number || github.ref }}
14+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
15+
16+
jobs:
17+
scanning:
18+
name: GitGuardian scan
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v6
23+
with:
24+
fetch-depth: 0
25+
26+
- name: GitGuardian scan
27+
uses: GitGuardian/ggshield/actions/secret@v1.51.0
28+
env:
29+
GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
30+
GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
31+
GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
32+
GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
33+
GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

‎docs/superpowers/plans/2026-06-11-gitguardian-ci.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# GitGuardian CI Workflow Implementation Plan
2+
3+
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
4+
5+
**Goal:** Add an independent GitGuardian secret-scanning GitHub Actions workflow for `develop`.
6+
7+
**Architecture:** Create one standalone workflow under `.github/workflows/` that mirrors the repository's existing `develop` branch policy, grants read-only contents permission, checks out full history, and invokes GitGuardian's official ggshield secret scan action with the existing `GITGUARDIAN_API_KEY` secret.
8+
9+
**Tech Stack:** GitHub Actions YAML, GitGuardian ggshield action, repository secret `GITGUARDIAN_API_KEY`.
10+
11+
---
12+
13+
## File Structure
14+
15+
- Create `.github/workflows/gitguardian.yml`: standalone GitGuardian secret-scanning workflow.
16+
- No source code files change.
17+
- No existing CI workflow changes are required.
18+
19+
## Task 1: Add GitGuardian Workflow
20+
21+
**Files:**
22+
- Create: `.github/workflows/gitguardian.yml`
23+
24+
- [ ] **Step 1: Create the workflow file**
25+
26+
Create `.github/workflows/gitguardian.yml`:
27+
28+
```yaml
29+
name: GitGuardian scan
30+
31+
on:
32+
push:
33+
branches: [develop]
34+
pull_request:
35+
branches: [develop]
36+
37+
permissions:
38+
contents: read
39+
40+
concurrency:
41+
group: gitguardian-${{ github.event.pull_request.number || github.ref }}
42+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
43+
44+
jobs:
45+
scanning:
46+
name: GitGuardian scan
47+
runs-on: ubuntu-latest
48+
steps:
49+
- name: Checkout
50+
uses: actions/checkout@v6
51+
with:
52+
fetch-depth: 0
53+
54+
- name: GitGuardian scan
55+
uses: GitGuardian/ggshield/actions/secret@v1.51.0
56+
env:
57+
GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
58+
GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
59+
GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
60+
GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
61+
GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
62+
```
63+
64+
- [ ] **Step 2: Inspect the workflow file**
65+
66+
Run:
67+
68+
```bash
69+
sed -n '1,160p' .github/workflows/gitguardian.yml
70+
```
71+
72+
Expected: the file contains `push` and `pull_request` triggers for `develop`, `contents: read`, `fetch-depth: 0`, and `GITGUARDIAN_API_KEY`.
73+
74+
- [ ] **Step 3: Run local precommit quality gate**
75+
76+
Run:
77+
78+
```bash
79+
pnpm quality:precommit
80+
```
81+
82+
Expected: lint, typecheck, tests, and workflow tests pass.
83+
84+
- [ ] **Step 4: Run GitNexus change detection**
85+
86+
Run GitNexus `detect_changes` with `scope: "all"` for `/Users/a86198/FrontAgent`.
87+
88+
Expected: changed scope is limited to the new GitGuardian workflow plus the planning/design documents; no source-code symbols or product execution flows are affected.

‎docs/superpowers/specs/2026-06-11-gitguardian-ci-design.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# GitGuardian CI Workflow Design
2+
3+
Date: 2026-06-11
4+
Repository: `FrontAgent/FrontAgent`
5+
Base branch: `develop`
6+
7+
## Goal
8+
9+
Add an independent GitGuardian secret-scanning workflow that uses the repository secret
10+
`GITGUARDIAN_API_KEY` and follows the existing FrontAgent CI trigger pattern.
11+
12+
## Context
13+
14+
FrontAgent already runs CI, Contract Guard, and Repo Guard from `.github/workflows/`.
15+
Existing CI and Contract Guard target `develop`, so the GitGuardian workflow should use
16+
the same branch policy unless maintainers explicitly broaden the security coverage.
17+
18+
GitGuardian's current GitHub Actions documentation recommends running ggshield from
19+
GitHub Actions, checking out full history with `fetch-depth: 0`, and passing
20+
`GITGUARDIAN_API_KEY` through the environment.
21+
22+
## Selected Approach
23+
24+
Create a standalone `.github/workflows/gitguardian.yml` workflow.
25+
26+
This keeps secret scanning separate from Node quality checks and makes the
27+
`GitGuardian scan` status easy to add as a required check. The workflow should trigger
28+
on pushes to `develop` and pull requests targeting `develop`.
29+
30+
## Workflow Behavior
31+
32+
- Workflow name: `GitGuardian scan`.
33+
- Events:
34+
- `push` to `develop`.
35+
- `pull_request` targeting `develop`.
36+
- Permissions: `contents: read`.
37+
- Concurrency:
38+
- Group by PR number when available, otherwise by ref.
39+
- Cancel in-progress runs for pull request updates.
40+
- Job:
41+
- Runs on `ubuntu-latest`.
42+
- Checks out the repository with `actions/checkout@v6`.
43+
- Uses `fetch-depth: 0` so ggshield can scan the relevant commit range.
44+
- Runs `GitGuardian/ggshield/actions/secret@v1.51.0`.
45+
- Passes the official GitHub SHA environment variables plus
46+
`GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}`.
47+
48+
## Error Handling
49+
50+
The workflow should fail when GitGuardian detects exposed secrets or when the
51+
configured API key is missing/invalid. No local fallback or soft-fail behavior is
52+
included because this is a security gate.
53+
54+
## Testing
55+
56+
Local verification should include:
57+
58+
- YAML structure inspection by reading the new workflow file.
59+
- `pnpm quality:precommit`, because `.github/workflows/` is a repo-harness critical
60+
skeleton path in `docs/knowledge-contract.md`.
61+
- `mcp__gitnexus.detect_changes` before final review to confirm the affected scope.
62+
63+
## Out Of Scope
64+
65+
- Adding a `.gitguardian.yaml` ignore policy.
66+
- Enabling GitGuardian full-history repository monitoring outside GitHub Actions.
67+
- Changing branch protection settings.
68+
- Modifying existing CI, Contract Guard, or Repo Guard behavior.

0 commit comments

Comments
 (0)