Skip to content

chore(ci): migrate secrets-scan-daily workflow to GitHub keyless auth #2844

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matiasinsaurralde merged 1 commit into from
Mar 14, 2026
Merged

chore(ci): migrate secrets-scan-daily workflow to GitHub keyless auth #2844

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 6 additions & 17 deletions .github/workflows/secrets-scan-daily.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,29 +6,18 @@ on:
- cron: '0 9 * * *'
workflow_dispatch: # Allow manual triggering

permissions:
contents: read
id-token: write # Required for SLSA attestation
permissions: read-all

jobs:
onboard_workflow:
name: Onboard Chainloop Workflow
uses: chainloop-dev/labs/.github/workflows/chainloop_onboard.yml@6bbd1c2b3022e48ae60afa0c2b90f3b6d31bcf11
with:
project: "chainloop"
workflow_name: "daily-secrets-detection"
secrets:
api_token: ${{ secrets.CHAINLOOP_TOKEN }}

daily-secrets-scan:
name: Daily Secrets Scan
needs: onboard_workflow
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
env:
CHAINLOOP_TOKEN: ${{ secrets.CHAINLOOP_TOKEN }}
CHAINLOOP_WORKFLOW_NAME: ${{ needs.onboard_workflow.outputs.workflow_name }}
CHAINLOOP_PROJECT_NAME: ${{ needs.onboard_workflow.outputs.project_name }}
GITHUB_TOKEN: ${{ github.token }}
CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
CHAINLOOP_PROJECT_NAME: "chainloop"
Comment on lines +19 to +20

@cubic-dev-ai cubic-dev-ai Bot Mar 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Keep GITHUB_TOKEN in this env block so attestation init can still verify the head commit through the GitHub API.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/secrets-scan-daily.yml, line 19:

<comment>Keep `GITHUB_TOKEN` in this env block so attestation init can still verify the head commit through the GitHub API.</comment>

<file context>
@@ -6,29 +6,18 @@ on:
-      CHAINLOOP_WORKFLOW_NAME: ${{ needs.onboard_workflow.outputs.workflow_name }}
-      CHAINLOOP_PROJECT_NAME: ${{ needs.onboard_workflow.outputs.project_name }}
-      GITHUB_TOKEN: ${{ github.token }}
+      CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
+      CHAINLOOP_PROJECT_NAME: "chainloop"
 
</file context>
Suggested change
CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
CHAINLOOP_PROJECT_NAME: "chainloop"
CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
CHAINLOOP_PROJECT_NAME: "chainloop"
GITHUB_TOKEN: ${{ github.token }}
Fix with Cubic


steps:
- uses: actions/checkout@v4
Expand Down
Loading