Switch to plaintext fingerprint

gitleaks / gitleaks-action

Protect your secrets using Gitleaks-Action

https://gitleaks.io

Other

332 stars 128 forks source link

Switch to plaintext fingerprint #98

Closed weineran closed 2 years ago

weineran commented 2 years ago

Changed repo ("machine") fingerprint to plaintext full_name of repo
This also allowed me to remove a lot of the code that was specific to the schedule event.
It looks like repository.html_url and repository.full_name are already included in the schedule event: https://github.com/dhimmel/dump-actions-context/actions/runs/3191708047/jobs/5208342350 (but we should test)

weineran commented 2 years ago

@zricethezav Can you review? But do not merge yet because:

package-lock.json changed a lot, which it shouldn't. Need to check that.
Need to test, especially "schedule" event
We should clear out the machines list before we merge, then we should merge and release, then clear out the machines list again. Then monitor for a couple days to see if anyone is pinned to a minor version.

zricethezav commented 2 years ago

@weineran changes look good to me. I'm glad we can remove the "schedule" event backfill code. Let me know if you want me to build dist then rebase to see if that fixes the package-lock.json diff.

Gonna be busy for a few hours this morning, but will have some time this afternoon

weineran commented 2 years ago

[x] fixed my node version and node modules so there are no changes to package-lock.json
[x] scheduled events seem to be working: https://github.com/gitleaks/private-test/actions/runs/3210692695/jobs/5248333569, https://github.com/gitleaks/private-test/actions/runs/3210690342/jobs/5248329786

Let's plan to merge this on Monday during our meeting. We should clear out the machines list right before we merge, then we should merge and release, then clear out the machines list again. Then monitor for a couple days to see if anyone is pinned to a minor version.

weineran commented 2 years ago

If you get some time, go for it! Otherwise, I will!

On Fri, Oct 7, 2022, 6:42 AM Zachary Rice @.***> wrote:

@weineran https://github.com/weineran changes look good to me. I'm glad we can remove the "schedule" event backfill code. Let me know if you want me to build dist then rebase to see if that fixes the package-lock.json diff.

Gonna be busy for a few hours this morning, but will have some time this afternoon

— Reply to this email directly, view it on GitHub https://github.com/gitleaks/gitleaks-action/pull/98#issuecomment-1271612132, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABNAEIPBTLV5AEUXRDZ2KU3WCASF7ANCNFSM6AAAAAAQ7G6DHI . You are receiving this because you were mentioned.Message ID: @.***>