From 25bd4dbc7d849b68f71b14858cafe1050e2fc97d Mon Sep 17 00:00:00 2001 From: Adam Koyuncu <50804772+adamkoy@users.noreply.github.com> Date: Mon, 28 Sep 2026 15:48:37 -0300 Subject: [PATCH 1/5] ci: load the org Gitleaks baseline for EVM private keys The stock action misses deployer_pk-style keys. Fetch the shared baseline so a 32-byte hex is caught regardless of the variable name. --- .github/workflows/secret-scan.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index e64cd68..5c3c836 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -4,6 +4,7 @@ # https://github.com/gitleaks/gitleaks-action # Org repos need a free GITLEAKS_LICENSE (gitleaks.io) as an Actions secret. # Comments and SARIF upload are off so a finding is not published on a public PR. +# Org baseline adds the EVM 32-byte rules (deployer_pk, bare hex). ############################################################################### name: Secret scan @@ -33,11 +34,19 @@ jobs: fetch-depth: 0 persist-credentials: false + - name: Fetch org Gitleaks baseline + # EVM rules from m0-platform/secret-scan @ 640b598d5685d92449a7529bd29854823ee23481 + # gitleaks reads GITLEAKS_CONFIG. Comments stay off on public PRs. + run: | + curl -fsSL -o /tmp/m0-gitleaks.toml \ + https://raw.githubusercontent.com/m0-platform/secret-scan/640b598d5685d92449a7529bd29854823ee23481/.github/actions/secret-scan/gitleaks.toml + - name: Run Gitleaks # gitleaks/gitleaks-action v3.0.0 uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} + GITLEAKS_CONFIG: /tmp/m0-gitleaks.toml GITLEAKS_ENABLE_COMMENTS: "false" GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false" From a8e12584c8ad5051fa823e565d594f7eada5959e Mon Sep 17 00:00:00 2001 From: Adam Koyuncu <50804772+adamkoy@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:15:32 -0300 Subject: [PATCH 2/5] ci: scan the full repo history with the org Gitleaks workflow Call the pinned secret-scan workflow so EVM rules apply and every commit in the repo is scanned, not only the pull request diff. --- .github/workflows/secret-scan.yml | 38 ++++++------------------------- 1 file changed, 7 insertions(+), 31 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 5c3c836..5f4d2f28 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -1,10 +1,9 @@ ############################################################################### -# Secret scan — public Gitleaks action +# Secret scan # -# https://github.com/gitleaks/gitleaks-action -# Org repos need a free GITLEAKS_LICENSE (gitleaks.io) as an Actions secret. -# Comments and SARIF upload are off so a finding is not published on a public PR. -# Org baseline adds the EVM 32-byte rules (deployer_pk, bare hex). +# Calls the public org scanner at a pinned commit. That commit carries the EVM +# baseline (deployer_pk and bare 32-byte hex). gitleaks git scans the full +# history of this repo, not only the commits in the pull request. ############################################################################### name: Secret scan @@ -24,29 +23,6 @@ permissions: jobs: gitleaks: name: Secret Scan (Gitleaks) - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - name: Checkout repository - # actions/checkout v4.3.1 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - with: - fetch-depth: 0 - persist-credentials: false - - - name: Fetch org Gitleaks baseline - # EVM rules from m0-platform/secret-scan @ 640b598d5685d92449a7529bd29854823ee23481 - # gitleaks reads GITLEAKS_CONFIG. Comments stay off on public PRs. - run: | - curl -fsSL -o /tmp/m0-gitleaks.toml \ - https://raw.githubusercontent.com/m0-platform/secret-scan/640b598d5685d92449a7529bd29854823ee23481/.github/actions/secret-scan/gitleaks.toml - - - name: Run Gitleaks - # gitleaks/gitleaks-action v3.0.0 - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} - GITLEAKS_CONFIG: /tmp/m0-gitleaks.toml - GITLEAKS_ENABLE_COMMENTS: "false" - GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false" + permissions: + contents: read + uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@640b598d5685d92449a7529bd29854823ee23481 From 323b2bc3cc8da608507ada301874db5de6477b87 Mon Sep 17 00:00:00 2001 From: Adam Koyuncu <50804772+adamkoy@users.noreply.github.com> Date: Tue, 29 Sep 2026 09:41:20 -0300 Subject: [PATCH 3/5] ci: pin the Gitleaks baseline that ignores 1Password op:// references Vault pointers are not secrets. The key is injected by the op CLI at runtime. --- .github/workflows/secret-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 5f4d2f28..118c63a 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -25,4 +25,4 @@ jobs: name: Secret Scan (Gitleaks) permissions: contents: read - uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@640b598d5685d92449a7529bd29854823ee23481 + uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@3272da02553e76c6f4b62f1ce64334053b8b73b6 From 10e423d125b1edf5649a4ea3fa71fd31b3b611ca Mon Sep 17 00:00:00 2001 From: Adam Koyuncu <50804772+adamkoy@users.noreply.github.com> Date: Tue, 29 Sep 2026 09:45:25 -0300 Subject: [PATCH 4/5] ci: track secret-scan@main so allow-list updates do not need a pin bump False-positive rules can change in one place while these callers stay put. --- .github/workflows/secret-scan.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 118c63a..1279028 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -1,9 +1,8 @@ ############################################################################### # Secret scan # -# Calls the public org scanner at a pinned commit. That commit carries the EVM -# baseline (deployer_pk and bare 32-byte hex). gitleaks git scans the full -# history of this repo, not only the commits in the pull request. +# Calls the public org scanner on main. Allow-list updates there apply on the +# next run, with no pin bump in this repo. gitleaks git scans the full history. ############################################################################### name: Secret scan @@ -25,4 +24,4 @@ jobs: name: Secret Scan (Gitleaks) permissions: contents: read - uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@3272da02553e76c6f4b62f1ce64334053b8b73b6 + uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@main From c01ede28f13e286eedf130194cf608b0218c4a16 Mon Sep 17 00:00:00 2001 From: Adam Koyuncu Date: Wed, 30 Sep 2026 15:35:15 -0300 Subject: [PATCH 5/5] ci: re-run secret scan against the org baseline