From 836ee40654b68989e81d581d762b03aa197c5fad Mon Sep 17 00:00:00 2001 From: Duncan Macleod Date: Wed, 24 Apr 2024 13:41:38 +0100 Subject: [PATCH 1/8] use CI_ variables to allow mirroring to other gitlab instances --- .gitlab-ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 5cfe312..1db20a7 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,5 +1,5 @@ include: - component: gitlab.com/$CI_PROJECT_PATH/secret-detection@$CI_COMMIT_SHA + component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/secret-detection@$CI_COMMIT_SHA stages: [test, release] @@ -14,7 +14,7 @@ ensure-job-added: script: - echo "Expect that a job named 'secret_detection' is added to the pipeline" - | - route="https://gitlab.com/api/v4/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/jobs" + route="$CI_API_V4_URL/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/jobs" count=`curl --silent $route | jq 'map(select(.name | contains("secret_detection"))) | length'` if [ "$count" != "1" ]; then exit 1 @@ -26,7 +26,7 @@ check-description: image: badouralix/curl-jq script: - | - route="https://gitlab.com/api/v4/projects/$CI_PROJECT_ID" + route="$CI_API_V4_URL/projects/$CI_PROJECT_ID" desc=`curl --silent $route | jq '.description'` if [ "$desc" = "null" ]; then echo "Description not set. Please set a projet description" From 7c550c89519082e7753341d90f14df29e9179b2c Mon Sep 17 00:00:00 2001 From: Vishwa Bhat Date: Thu, 2 May 2024 14:51:06 +0000 Subject: [PATCH 2/8] Update Secret Detection analyzer version --- templates/secret-detection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/secret-detection.yml b/templates/secret-detection.yml index bd1e3ad..abe599b 100644 --- a/templates/secret-detection.yml +++ b/templates/secret-detection.yml @@ -5,7 +5,7 @@ spec: image_prefix: default: "$CI_TEMPLATE_REGISTRY_HOST/security-products" image_tag: - default: '5' + default: '6' image_suffix: default: "" --- From d9f655a96a2fac9b4a972b89d8ed1ccb7ef2e8c1 Mon Sep 17 00:00:00 2001 From: Ahmed Hemdan Date: Tue, 25 Jun 2024 14:02:45 +0200 Subject: [PATCH 3/8] Run a couple of jobs only on Gitlab.com --- .gitlab-ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 1db20a7..b47a28d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -19,6 +19,8 @@ ensure-job-added: if [ "$count" != "1" ]; then exit 1 fi + rules: + - if: ($CI_COMMIT_BRANCH || $CI_COMMIT_TAG) && $CI_SERVER_HOST =~ /gitlab.com/ # Ensure that a project description exists, because it will be important to display # the resource in the catalog. @@ -34,6 +36,8 @@ check-description: else echo "Description set" fi + rules: + - if: $CI_SERVER_HOST =~ /gitlab.com/ # Ensure that a `README.md` exists in the root directory as it represents the # documentation for the whole components repository. From 5e5d5be4d65d28698011ff4d442ad6776035be85 Mon Sep 17 00:00:00 2001 From: Ahmed Hemdan Date: Thu, 18 Jul 2024 19:37:55 +0200 Subject: [PATCH 4/8] Add a codeowners file --- CODEOWNERS | 1 + 1 file changed, 1 insertion(+) create mode 100644 CODEOWNERS diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000..8c09c67 --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1 @@ +* @gitlab-org/secure/secret-detection From f945a715cdb9f0f5230c563b189e3c1207c03939 Mon Sep 17 00:00:00 2001 From: Ahmed Hemdan Date: Fri, 14 Feb 2025 11:17:45 +0100 Subject: [PATCH 5/8] Add LICENSE --- LICENSE | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 LICENSE diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..0fb88d0 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 GitLab Inc. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. From d5021f7972422d9b7f09fcd1337dee8f4f8ad2c3 Mon Sep 17 00:00:00 2001 From: Ahmed Hemdan Date: Mon, 21 Apr 2025 23:41:40 +0200 Subject: [PATCH 6/8] Bump version to 7 --- templates/secret-detection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/secret-detection.yml b/templates/secret-detection.yml index abe599b..79c1e0b 100644 --- a/templates/secret-detection.yml +++ b/templates/secret-detection.yml @@ -5,7 +5,7 @@ spec: image_prefix: default: "$CI_TEMPLATE_REGISTRY_HOST/security-products" image_tag: - default: '6' + default: '7' image_suffix: default: "" --- From 54aa5f1aa93603b5f9c5e3b5fbb78d2d8811b8db Mon Sep 17 00:00:00 2001 From: Ahmed Hemdan Date: Tue, 22 Apr 2025 10:32:02 +0200 Subject: [PATCH 7/8] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6830909..b9babd2 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ This assumes `SECRET_DETECTION_DISABLED` variable is already defined in `.gitlab | ----- | ------------- | ----------- | | `stage` | `test` | The stage where you want the job to be added. | | `image_prefix` | `$CI_TEMPLATE_REGISTRY_HOST/security-products` | Override the name of the Docker registry providing the default images (proxy). | -| `image_tag` | `5` | Override the default version of the `secrets` analyzer image. | +| `image_tag` | `7`| Override the default version of the `secrets` analyzer image. | | `image_suffix` | `""` | Suffix added to the image name. If set to -fips, [FIPS-enabled images](https://docs.gitlab.com/ee/user/application_security/secret_detection/#use-fips-enabled-images) are used for scan. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/355519) in GitLab 14.10. | ### Variables From e1192e05d161fad8390872d8feabd4454dd0ec97 Mon Sep 17 00:00:00 2001 From: Ahmed Hemdan Date: Tue, 22 Apr 2025 10:32:37 +0200 Subject: [PATCH 8/8] Fix spacing --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b9babd2..bd29082 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ This assumes `SECRET_DETECTION_DISABLED` variable is already defined in `.gitlab | ----- | ------------- | ----------- | | `stage` | `test` | The stage where you want the job to be added. | | `image_prefix` | `$CI_TEMPLATE_REGISTRY_HOST/security-products` | Override the name of the Docker registry providing the default images (proxy). | -| `image_tag` | `7`| Override the default version of the `secrets` analyzer image. | +| `image_tag` | `7` | Override the default version of the `secrets` analyzer image. | | `image_suffix` | `""` | Suffix added to the image name. If set to -fips, [FIPS-enabled images](https://docs.gitlab.com/ee/user/application_security/secret_detection/#use-fips-enabled-images) are used for scan. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/355519) in GitLab 14.10. | ### Variables