detect-secrets.yml

name: detect secrets

on: push

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "detect-secrets"
  detect-secrets:
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:

      # Checks-out your repository under ${{github.workspace}}, so your job can access it
      - uses: actions/checkout@v4

      - name: scan all the files (not just the ones committed), generate a report, and check that there are no actual or potential secret
        run: |
          docker run --pull=always -a stdout \
          -v ${{github.workspace}}:/code \
          --entrypoint /bin/sh \
          icr.io/git-defenders/detect-secrets:0.13.1.ibm.61.dss-redhat-ubi \
          -c "detect-secrets --version; 
              detect-secrets scan --all-files --exclude-files "^.git/.*" --update .secrets.baseline --exclude-files 'package-lock.json|FETCH_HEAD'; 
              detect-secrets audit --report --fail-on-unaudited --fail-on-live --fail-on-audited-real .secrets.baseline" 

      - name: Report Status
        if: always()
        uses: ravsamhq/notify-slack-action@master
        with:
          status: ${{ job.status }}
          notify_when: 'failure'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}