diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index be9167adda2..27e60fd85b8 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -35,46 +35,46 @@ install_ggshield() { } # # Function to run secret detection scans -# run_secret_detection() { -# echo "Running secret detection scans..." +run_secret_detection() { + echo "Running secret detection scans..." -# if ! command -v ggshield &> /dev/null; then -# install_ggshield -# fi + if ! command -v ggshield &> /dev/null; then + install_ggshield + fi -# # Check if GITGUARDIAN_API_KEY is set (required for CI/CD) -# if [ -z "$GITGUARDIAN_API_KEY" ]; then -# echo "Warning: GITGUARDIAN_API_KEY environment variable is not set." -# echo "ggshield requires a GitGuardian API key to scan for secrets." -# echo "Please set GITGUARDIAN_API_KEY in your CI/CD environment variables." -# exit 1 -# fi + # Check if GITGUARDIAN_API_KEY is set (required for CI/CD) + if [ -z "$GITGUARDIAN_API_KEY" ]; then + echo "Warning: GITGUARDIAN_API_KEY environment variable is not set." + echo "ggshield requires a GitGuardian API key to scan for secrets." + echo "Please set GITGUARDIAN_API_KEY in your CI/CD environment variables." + exit 1 + fi -# echo "Scanning codebase for secrets..." -# echo "Note: Large codebases may take several minutes due to API rate limits (50 requests/minute on free plan)" -# echo "ggshield will automatically handle rate limits and retry as needed." -# echo "Binary files, cache files, and build artifacts are excluded via .gitguardian.yaml" + echo "Scanning codebase for secrets..." + echo "Note: Large codebases may take several minutes due to API rate limits (50 requests/minute on free plan)" + echo "ggshield will automatically handle rate limits and retry as needed." + echo "Binary files, cache files, and build artifacts are excluded via .gitguardian.yaml" -# # Use --recursive for directory scanning and auto-confirm if prompted -# # .gitguardian.yaml will automatically exclude binary files, wheel files, etc. -# # GITGUARDIAN_API_KEY environment variable will be used for authentication -# echo y | ggshield secret scan path . --recursive || { -# echo "" -# echo "==========================================" -# echo "ERROR: Secret Detection Failed" -# echo "==========================================" -# echo "ggshield has detected secrets in the codebase." -# echo "Please review discovered secrets above, revoke any actively used secrets" -# echo "from underlying systems and make changes to inject secrets dynamically at runtime." -# echo "" -# echo "For more information, see: https://docs.gitguardian.com/secrets-detection/" -# echo "==========================================" -# echo "" -# exit 1 -# } + # Use --recursive for directory scanning and auto-confirm if prompted + # .gitguardian.yaml will automatically exclude binary files, wheel files, etc. + # GITGUARDIAN_API_KEY environment variable will be used for authentication + echo y | ggshield secret scan path . --recursive || { + echo "" + echo "==========================================" + echo "ERROR: Secret Detection Failed" + echo "==========================================" + echo "ggshield has detected secrets in the codebase." + echo "Please review discovered secrets above, revoke any actively used secrets" + echo "from underlying systems and make changes to inject secrets dynamically at runtime." + echo "" + echo "For more information, see: https://docs.gitguardian.com/secrets-detection/" + echo "==========================================" + echo "" + exit 1 + } -# echo "Secret detection scans completed successfully" -# } + echo "Secret detection scans completed successfully" +} # Function to run Trivy scans run_trivy_scans() {