From 794bc8efc197d1469fab041f2fb19ec63e5f6123 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 17 Jul 2026 13:49:56 +0000 Subject: [PATCH] fix(ci): install ripgrep and exclude secret-scan false positives The security job secret scan was silently skipped when ripgrep was unavailable on runners. Install ripgrep and exclude docs, privacy redaction patterns, and dashboard test fixtures from the scan. Co-authored-by: Himan --- .github/workflows/ci.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fdc8438f..02e8baf9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -234,8 +234,15 @@ jobs: run: go install github.com/securego/gosec/v2/cmd/gosec@v2.22.2 && gosec -no-fail ./... - name: Secret scan run: | + sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep ! rg -n "(sk_live_|sk_test_|ghp_|gho_|AKIA|BEGIN (RSA |OPENSSH )?PRIVATE KEY)" \ - --glob '!*.md' --glob '!.github/**' . || \ + --glob '!*.md' \ + --glob '!*.mdx' \ + --glob '!.github/**' \ + --glob '!docs/**' \ + --glob '!internal/memory/privacy/**' \ + --glob '!dashboard/tests/**' \ + . || \ (echo "Possible secret detected" && exit 1) ci-success: