Detect secrets

[ms280690]

Scan the repository for secrets using the following tools:

1. Gitleaks: https://github.com/gitleaks/gitleaks
2. TruffleHog: https://github.com/trufflesecurity/trufflehog
3. detect-secrets: https://github.com/Yelp/detect-secrets
4. git-secrets: https://github.com/awslabs/git-secrets
5. Talisman: https://github.com/thoughtworks/talisman
6. credential-digger: https://github.com/SAP/credential-digger
7. kingfisher: https://github.com/mongodb/kingfisher

[Copilot]

Pull request overview

This PR adds comprehensive secret detection capabilities to the repository by implementing a GitHub Actions workflow that integrates seven different security scanning tools (Gitleaks, TruffleHog, detect-secrets, git-secrets, Talisman, credential-digger, and kingfisher).

• Implements a reusable GitHub Action for secret scanning with multiple industry-standard tools
• Creates a workflow that triggers on pushes and pull requests to the main branch
• Generates combined scan results as workflow artifacts for review

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 7 comments.

File	Description
.gitignore	Adds .venv to ignore virtual environment directories
.github/workflows/detect-secrets.yaml	Defines the workflow trigger and permissions for the secret scanning pipeline
.github/actions/detect-secrets/action.yaml	Implements the composite action that installs and runs all seven secret detection tools

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The 'gitleaks-license' input is marked as required but has a default value of empty string. An input cannot be both required and have an empty default. Either set 'required: false' if the license is optional, or remove the default value if it's truly required.

Suggested change

	required: true
	required: false

[Copilot]

The TruffleHog version is hardcoded as '3.92.4' in the script. This makes it difficult to maintain and update. Consider extracting this as an input parameter with a default value, or using 'latest' from the GitHub releases API to avoid manually updating version numbers.

[Copilot]

The step uses 'set -euo pipefail' for strict error handling, but the parent step has 'continue-on-error: true' which negates the benefit of strict error handling. If installation fails, it will continue silently. This creates inconsistent error handling behavior.

Suggested change

set -euo pipefail

[Copilot]

The TruffleHog installation uses 'continue-on-error: true' which means if the installation fails, the workflow will continue without running TruffleHog. This silently skips the scan if installation fails. Consider moving this flag to the 'Run TruffleHog' step instead, or add explicit validation that the binary was installed successfully before attempting to run it.

[Copilot]

The TruffleHog binary is installed to a temporary directory using '$RUNNER_TEMP' but is not added to the PATH. If the subsequent 'Run TruffleHog' step fails to execute, it will be difficult to debug whether the issue is a missing binary or an actual scan failure. Consider adding the binary to a well-known location or validating its presence before the scan step.

[Copilot]

Installing software by piping curl output directly to bash poses a security risk as it executes arbitrary code from a remote source without validation. Consider downloading the script first, reviewing it, and then executing it, or use a specific versioned release with checksum verification.

Suggested change

	run: bash -c "$(curl --silent https://raw.githubusercontent.com/thoughtworks/talisman/main/install.sh)"
	run: |
	set -euo pipefail
	curl --fail --show-error --silent --location \
	-o /tmp/talisman-install.sh \
	https://raw.githubusercontent.com/thoughtworks/talisman/main/install.sh
	bash /tmp/talisman-install.sh

[Copilot]

Installing software by piping curl output directly to bash poses a security risk as it executes arbitrary code from a remote source without validation. Consider downloading the script first, reviewing it, and then executing it, or use a specific versioned release with checksum verification.