From 47978c4d58e8b7bf5525e88b8283b6b14895e829 Mon Sep 17 00:00:00 2001 From: Juha Kangas <42040080+valuecodes@users.noreply.github.com> Date: Sat, 31 Oct 2026 17:08:01 +0200 Subject: [PATCH] chore: move to maintain-kit v1.0.0 and its secret-scan workflow Co-Authored-By: Claude Opus 5.5 --- .claude/settings.json | 1 - .github/scripts/secrets-scan.sh | 46 -------------------- .github/workflows/checks.yml | 21 +++------ .github/workflows/maintain-kit-dashboard.yml | 19 ++++++++ .github/workflows/maintenance-dashboard.yml | 19 -------- AGENTS.md | 35 ++++++++------- README.md | 18 +++++--- package.json | 1 - 8 files changed, 52 insertions(+), 108 deletions(-) delete mode 100644 .github/scripts/secrets-scan.sh create mode 100644 .github/workflows/maintain-kit-dashboard.yml delete mode 100644 .github/workflows/maintenance-dashboard.yml diff --git a/.claude/settings.json b/.claude/settings.json index ee2a6cc..0b46e81 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -8,7 +8,6 @@ "Bash(pnpm format:*)", "Bash(pnpm format:check:*)", "Bash(pnpm test:*)", - "Bash(pnpm secrets:scan:*)", "Bash(pnpm knip:*)", "Bash(pnpm --filter:*)", "Bash(gh api:*)" diff --git a/.github/scripts/secrets-scan.sh b/.github/scripts/secrets-scan.sh deleted file mode 100644 index e393edb..0000000 --- a/.github/scripts/secrets-scan.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/bin/sh -# Scan the repo's git history for committed secrets with gitleaks. -# -# Used by `pnpm secrets:scan` and by the `secrets-scan` CI job, so the pinned -# version below is the single source of truth for both. A local `gitleaks` -# binary is preferred when it is on PATH and new enough to have the `git` -# subcommand (v8.19+); otherwise the pinned Docker image runs instead. Extra -# arguments are passed through to `gitleaks git`, e.g. -# `pnpm secrets:scan --log-opts="origin/main..HEAD"`. -# -# Exit code is gitleaks' own: 0 clean, 1 leaks found. 2 means neither runner -# is available. -set -eu - -GITLEAKS_VERSION="8.30.1" -# Digest of the v$GITLEAKS_VERSION multi-arch image, so a re-pushed tag cannot -# change what runs. Bump both together. -GITLEAKS_DIGEST="sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f" - -repo_root=$(git rev-parse --show-toplevel) - -if command -v gitleaks >/dev/null 2>&1 && gitleaks git --help >/dev/null 2>&1; then - exec gitleaks git --redact --verbose "$@" "$repo_root" -fi - -if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then - # Mount read-only (gitleaks only reads) at the real absolute path, not /repo: - # in a git worktree `.git` is a file pointing at an absolute path inside the - # main checkout's git dir, which therefore has to be mounted at its own path. - git_common_dir=$(cd "$repo_root" && cd "$(git rev-parse --git-common-dir)" && pwd) - set -- -v "$repo_root:$repo_root:ro" \ - "ghcr.io/gitleaks/gitleaks:v$GITLEAKS_VERSION@$GITLEAKS_DIGEST" \ - git --redact --verbose "$@" "$repo_root" - case "$git_common_dir" in - "$repo_root"/*) ;; - *) set -- -v "$git_common_dir:$git_common_dir:ro" "$@" ;; - esac - exec docker run --rm "$@" -fi - -cat >&2 < [-- --prod] @@ -66,15 +65,17 @@ imports. There is no post-edit formatting hook: run `pnpm format` yourself before committing. -`secrets:scan` runs gitleaks (`.github/scripts/secrets-scan.sh`, version pinned -there) using a local `gitleaks` v8.19+ if one is on PATH, otherwise the pinned Docker image. -It exits 0 when clean and 1 when it finds a leak. +There are no git hooks. CI scans the full git history for secrets with the gitleaks +version pinned in `secret-scan.yml` from `valuecodes/maintain-kit`, so this repo holds +no gitleaks pin; a local `gitleaks git --staged` (gitleaks v8.19+) does the same for +staged changes before a commit. CI checks are defined once, in the reusable `.github/workflows/checks.yml`: typecheck, -lint, knip, format:check, test, secrets-scan, CodeQL code scanning -(`javascript-typescript`) and workflow-lint. workflow-lint calls the reusable workflow -from `valuecodes/automation`: actionlint (with shellcheck) and zizmor over the workflow -and action files. Each tool reads `.github/actionlint.yaml` / `zizmor.yml` if added. The +lint, knip, format:check, test, CodeQL code scanning (`javascript-typescript`), +secret-scan and workflow-lint. secret-scan and workflow-lint call the reusable workflows +from `valuecodes/maintain-kit`: gitleaks over the full git history, and actionlint (with +shellcheck) and zizmor over the workflow and action files. Each tool reads +`.github/actionlint.yaml` / `zizmor.yml` if added. The typecheck and test jobs restore Turbo's `.turbo` cache from the previous run of the same task, so unchanged packages replay instead of rerunning. Two workflows call it: @@ -89,18 +90,16 @@ D1 migrations are a separate workflow (`migrations.yml`): it runs on push to `ma Dependabot (`.github/dependabot.yml`) bumps the SHA-pinned actions and reusable workflows monthly in one grouped PR; npm dependencies are updated by hand. -`maintenance-dashboard.yml` calls the maintenance dashboard workflow from -`valuecodes/automation` daily. -It keeps one issue, **Maintenance dashboard** (label `maintenance-dashboard`), listing -what is due: `catalog:` updates, pnpm (`packageManager`), gitleaks (`GITLEAKS_VERSION` -in the secrets-scan script), Node.js (`.nvmrc`) and `pnpm audit` findings. Like +`maintain-kit-dashboard.yml` calls the dashboard workflow from +`valuecodes/maintain-kit` daily. +It keeps one issue, **Maintenance dashboard** (label `maintain-kit-dashboard`), listing +what is due: `catalog:` updates, pnpm (`packageManager`), Node.js (`.nvmrc`) and +`pnpm audit` findings. Like `minimumReleaseAge`, a release shows up only once it is 14 days old; a Node.js security release shows up right away and is flagged. It never opens PRs or commits; doing the updates stays manual. For a Node.js bump, change only `.nvmrc` (the one place that -holds the exact version). If `GITLEAKS_VERSION` moves out of -`.github/scripts/secrets-scan.sh`, pass the new path as the `gitleaks-script` input. -The dashboard and workflow-lint callers pin the same `valuecodes/automation` commit, so -bump them together. +holds the exact version). The dashboard, secret-scan and workflow-lint callers pin the +same `valuecodes/maintain-kit` commit, so bump them together. --- diff --git a/README.md b/README.md index 9a868ab..e99fb65 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ packages/ telegram/ # Telegram Bot API client typescript/ # Shared TypeScript config url-validator/ # Safety policy checks for user-supplied URLs -.github/ # CI workflow, composite setup action, secrets-scan script +.github/ # CI workflows, composite setup action .oxlintrc.json # Single root lint config .oxfmtrc.jsonc # Single root format config ``` @@ -73,7 +73,6 @@ pnpm typecheck # type checking pnpm lint # oxlint pnpm knip # unused files, exports and dependencies pnpm test # run tests -pnpm secrets:scan # gitleaks over git history pnpm format:check # check formatting pnpm format # fix formatting ``` @@ -87,10 +86,15 @@ to tunnel to your local worker. See ## CI and repo settings The checks live in `.github/workflows/checks.yml`: typecheck, lint, knip, format:check, -test, a gitleaks secret scan, CodeQL and actionlint + zizmor over the workflow files. -`feature.yml` runs them on PRs and fans them into `all-passed`; `main.yml` runs them on -push to `main`, then the `deploy` job deploys the workers. GitHub settings this relies -on: +test, CodeQL, a gitleaks secret scan over the full git history and actionlint + zizmor +over the workflow files; the last two run through the reusable `secret-scan.yml` and +`workflow-lint.yml` from `valuecodes/maintain-kit`. `feature.yml` runs them on PRs and +fans them into `all-passed`; `main.yml` runs them on push to `main`, then the `deploy` +job deploys the workers. There are no git hooks: to scan staged changes before a +commit, run `gitleaks git --staged` with gitleaks v8.19+ (`brew install gitleaks` on +macOS, Linux and WSL, or unpack the `linux_x64` tarball from the +[releases page](https://github.com/gitleaks/gitleaks/releases) into a directory on +PATH such as `~/.local/bin`). GitHub settings this relies on: 1. **Rules → Rulesets**: the `main` ruleset requires a pull request and the `all-passed` status check, the only one to list. @@ -100,5 +104,5 @@ on: CodeQL uploads from `checks.yml`. 4. **Code security → Dependabot**: **alerts** on, **security updates** off. `.github/dependabot.yml` only bumps the SHA-pinned GitHub Actions monthly. -5. **Issues**: run the `Maintenance dashboard` workflow once, then pin the +5. **Issues**: run the `Maintain-kit dashboard` workflow once, then pin the **Maintenance dashboard** issue it creates. diff --git a/package.json b/package.json index dadb371..c02736f 100644 --- a/package.json +++ b/package.json @@ -18,7 +18,6 @@ "format": "oxfmt", "format:check": "oxfmt --check", "knip": "knip", - "secrets:scan": "sh .github/scripts/secrets-scan.sh", "clean": "turbo run clean" }, "devDependencies": {