Gate pull requests
Fail a pull request only when the scan finds a private finding.
- Scan the full history on every pull request and push to main
- The job prints a count, never a value
triagefindings are listed for review without blocking the merge
Onboard a repository to secret scanning
Turn a noisy first scan into a short list: what is real, what is safe by design, what needs a look.
- Run the scan once locally and read the
privateandtriagelists - Rotate what is real; files that hold secret-shaped text by design become reviewed exceptions
- Then add the CI job so the count stays at zero
One classifier for many repositories
Every repository installs the same package, so every CI job agrees on what is private.
- No per-repository ignore lists to drift apart
- Exceptions live in one reviewed file,
patterns.mjs - Line-bound exceptions stop holding when the reviewed line changes