n0s1-action

GitHub Action for n0s1

Run n0s1 secret scanner as GitHub action. Search for secret leaks on Jira, Confluence or Linear

Usage

Scan Jira

name: jira_secret_scanning
on:
  schedule:
    - cron: "0 10 *  *  *"
  workflow_dispatch:
    
jobs:
  jira_secret_scanning:
    name: Jira Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Run n0s1 secret scanner on Jira
        uses: spark1security/n0s1-action@main
        env:
          JIRA_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
        with:
          scan-target: 'jira_scan'
          user-email: 'service_account@<YOUR_COMPANY>.atlassian.net'
          platform-url: 'https://<YOUR_COMPANY>.atlassian.net'

Scan Linear.app

name: linear_secret_scanning
on:
  schedule:
    - cron: "0 11 *  *  *"
  workflow_dispatch:
    
jobs:
  linear_secret_scanning:
    name: Linear.app Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Run n0s1 secret scanner on Linear
        uses: spark1security/n0s1-action@main
        env:
          LINEAR_TOKEN: ${{ secrets.LINEAR_API_KEY }}
        with:
          scan-target: 'linear_scan'

Customized Scans

Example: Add comments to Jira

Scan Jira for any instances of a secret leak on a ticket, and when one is detected, append a comment to the ticket, recommending that the participants utilize 1Password and contact security@yourcompany.com if they require assistance.

name: jira_secret_scanning
on:
  schedule:
    - cron: "0 10 *  *  *"
  workflow_dispatch:
    
jobs:
  jira_secret_scanning:
    name: Jira Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Run n0s1 secret scanner on Jira
        uses: spark1security/n0s1-action@main
        env:
          JIRA_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
        with:
          scan-target: 'jira_scan'
          user-email: 'service_account@<YOUR_COMPANY>.atlassian.net'
          platform-url: 'https://<YOUR_COMPANY>.atlassian.net'
          post-comment: True
          secret-manager: '1Password'
          contact-help: 'security@yourcompany.com'

Example: Use customized regexes

Scan Linear with customized regex file ".github/workflows/config/my_regex.toml"

name: linear_secret_scanning
on:
  schedule:
    - cron: "0 11 *  *  *"
  workflow_dispatch:
    
jobs:
  linear_secret_scanning:
    name: Linear.app Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          ref: main
          sparse-checkout: |
            .github/workflows/config/my_regex.toml
      - name: Run n0s1 secret scanner on Linear
        uses: spark1security/n0s1-action@main
        env:
          LINEAR_TOKEN: ${{ secrets.LINEAR_API_KEY }}
        with:
          scan-target: 'linear_scan'
          regex-file: '.github/workflows/config/my_regex.toml'

Example: Scan Jira an upload results GitHub Codescanning

Scan Jira for any instances of a secret leak, and submit the findings to GitHub Security Codescanning.

name: jira_secret_scanning
on:
  schedule:
    - cron: "0 10 *  *  *"
  workflow_dispatch:
    
jobs:
  jira_secret_scanning:
    name: Jira Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Run n0s1 secret scanner on Jira
        uses: spark1security/n0s1-action@main
        env:
          JIRA_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
        with:
          scan-target: 'jira_scan'
          user-email: 'service_account@<YOUR_COMPANY>.atlassian.net'
          platform-url: 'https://<YOUR_COMPANY>.atlassian.net'
          report-file: 'jira_leaked_secrets.sarif'
          report-format: 'sarif'
      - name: Upload n0s1 secret scan results to GitHub Security Codescanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: jira_leaked_secrets.sarif

Example: Scan Jira an upload results to workflow artifact

Scan Jira for any instances of a secret leak, and save the report file to "n0s1-artifact".

name: jira_secret_scanning
on:
  schedule:
    - cron: "0 10 *  *  *"
  workflow_dispatch:
    
jobs:
  jira_secret_scanning:
    name: Jira Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Run n0s1 secret scanner on Jira
        uses: spark1security/n0s1-action@main
        env:
          JIRA_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
        with:
          scan-target: 'jira_scan'
          user-email: 'service_account@<YOUR_COMPANY>.atlassian.net'
          platform-url: 'https://<YOUR_COMPANY>.atlassian.net'
          report-file: 'jira_leaked_secrets.json'
      - name: Upload n0s1 secret scan report
        uses: actions/upload-artifact@v3
        with:
          name: n0s1-artifact
          path: jira_leaked_secrets.json
          retention-days: 5

Example: Debug Linear.app findings

Scan Linear.app for potential secret leaks and present the results in the GitHub Action logs. Please exercise caution, as including leaked secrets in the logs could exacerbate the issue by exposing the secrets to anyone with authorization to access the GitHub Action logs. Consider utilizing the 'show-matched-secret-on-logs' flag exclusively for debugging purposes.

name: linear_secret_scanning
on:
  schedule:
    - cron: "0 11 *  *  *"
  workflow_dispatch:
    
jobs:
  linear_secret_scanning:
    name: Linear.app Scanning for Secret Leaks
    runs-on: ubuntu-20.04
    steps:
      - name: Run n0s1 secret scanner on Linear
        uses: spark1security/n0s1-action@main
        env:
          LINEAR_TOKEN: ${{ secrets.LINEAR_API_KEY }}
        with:
          scan-target: 'linear_scan'
          show-matched-secret-on-logs: True

Community

n0s1 is a Spark 1 open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here