Skip to content

chore: setup pre-commit, CI secret scanning, and initial lint fixes - #25

Merged
jdaln merged 18 commits into
Medical-Informatics-Platform:masterfrom
moghit-eou:feat/gitleaks-pre-commit-hook
Oct 1, 2026
Merged

chore: setup pre-commit, CI secret scanning, and initial lint fixes#25
jdaln merged 18 commits into
Medical-Informatics-Platform:masterfrom
moghit-eou:feat/gitleaks-pre-commit-hook

Conversation

@moghit-eou

@moghit-eou moghit-eou commented Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Started as SARIF artifact encryption, grew to cover secret scanning and dependency
pinning along the way.

Secret scanning (new)

  • New secrets-scan.yml running Gitleaks on PRs and pushes to master.
  • Gitleaks added to ci/setup-tools.sh (SHA256 pinned) and to pre-commit.
  • ci/suppress_gitleaks.toml for allowlisting.

SARIF artifact encryption

Workflow artifacts inherit repository visibility and GitHub has no per-artifact
permissions, so raw SARIF was downloadable by anyone with read access to the repo.

  • Encrypt the merged report with gpg --symmetric before upload.
  • Skip with a warning when ARTIFACT_PASSWORD is unavailable (Dependabot, Renovate,
    fork PRs) instead of shipping a file encrypted with an empty passphrase.

Workflow cleanup

  • One merged SARIF upload per pipeline instead of one per tool.
  • Gate thresholds are now configurable via GATE_FAIL_THRESHOLD / GATE_WARN_THRESHOLD.

Supply chain

  • Dockerfile base images pinned to digests, HEALTHCHECK in JSON notation.
  • pre-commit hooks pinned to SHAs, four new hooks added.
  • Renovate now tracks pre-commit hooks, the semgrep-rules ref, and DOCKERIZE_VERSION.
  • Maven resolve moved into setup-tools.sh so local and CI match.
  • pom.xml: Spring Boot 4.0.7, Tomcat 11.0.25, Jackson 3.1.5.

Before merge

Add an ARTIFACT_PASSWORD repository secret.
Decrypt an artifact with:

gpg --decrypt --output report.sarif <name>.sarif.gpg

@github-advanced-security

github-advanced-security AI commented Aug 18, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@moghit-eou
moghit-eou force-pushed the feat/gitleaks-pre-commit-hook branch from efe24dd to afcc697 Compare August 18, 2026 10:35
@moghit-eou moghit-eou changed the title chore: setup pre-commit and initial lint fixes chore: setup pre-commit, CI secret scanning, and initial lint fixes Aug 18, 2026
@moghit-eou
moghit-eou force-pushed the feat/gitleaks-pre-commit-hook branch 2 times, most recently from 82e002d to 484d8f2 Compare August 18, 2026 22:09
@moghit-eou
moghit-eou force-pushed the feat/gitleaks-pre-commit-hook branch from b69f4ee to 1a428d9 Compare August 18, 2026 22:13
@moghit-eou
chore(renovate): track DOCKERIZE_VERSION
e25a3ba
@moghit-eou
docs: fix outdated repo layout in README
dfaed46
@moghit-eou
Bump Dockerize
a159937
@moghit-eou
chore(ci): align pipeline with blueprint (gate thresholds, maven reso…
f4eb91d 
…lve, codeql-action v4)
@moghit-eou
chore(renovate): auto-bump pre-commit hooks and semgrep-rules ref
6ebbb54 
- enable the pre-commit manager and switch hook revs to the
- add a git-refs custom manager to track semgrep-rules develop head branch
- add git-refs to the minimumReleaseAge cooldown list
@moghit-eou
moghit-eou marked this pull request as ready for review September 10, 2026 10:03
jdaln
jdaln reviewed Sep 10, 2026
View reviewed changes

@jdaln jdaln left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM,
Please @KFilippopolitis check the version bumps and approve + merge after testing

@jdaln

jdaln commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Let's wait for @KFilippopolitis to finish the big rework on #29 before merging this one.

@ThanKarab ThanKarab closed this Sep 29, 2026
@jdaln jdaln reopened this Sep 29, 2026
@ThanKarab

ThanKarab commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

Hello @moghit-eou , we will release the platform-backend tomorrow or the day after it.

Please rebase with master and push the PR again in the Medical-Informatics-Platform organization.

Thank you :)

@jdaln

jdaln commented Sep 30, 2026

Copy link
Copy Markdown
Contributor

@moghit-eou @KFilippopolitis has not yet pushed the new version it seems.

@jdaln

jdaln commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Good job @moghit-eou

@jdaln
jdaln merged commit 3d2734a into Medical-Informatics-Platform:master Oct 1, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdaln jdaln jdaln left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@moghit-eou @github-advanced-security @jdaln @ThanKarab