action.yml

name: "Infisical secrets check"
description: "Run Infisical secrets check on a GitHub repository."
branding:
  icon: "alert-triangle"
  color: "green"
inputs:
  GH_TOKEN:
    description: 'GitHub token'
    required: false
    default: ${{ github.TOKEN }}
  ADD_COMMENT:
    description: 'Comment result in the pull request'
    required: false
    default: true
outputs:
  secrets-leaked:
    description: "The number of secrets leaked found by the Infisical CLI tool."
    value: ${{ steps.count.outputs.secrets-leaked }}
runs:
  using: "composite"
  steps:
    - name: Check if PR is from a fork
      id: check_fork
      shell: bash
      run: |
        if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
          echo "FORKED=true" >> $GITHUB_ENV
        else
          echo "FORKED=false" >> $GITHUB_ENV
        fi

    - name: Checkout repo
      uses: actions/checkout@v6
      with:
        fetch-depth: 0

    - name: Cache pip packages
      uses: actions/cache@v5
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-csvkit-v1
        restore-keys: |
          ${{ runner.os }}-pip-

    - name: Cache npm global packages
      uses: actions/cache@v5
      with:
        path: ~/.cache/npm
        key: ${{ runner.os }}-npm-csv2md-v1
        restore-keys: |
          ${{ runner.os }}-npm-

    - name: Get latest valid Infisical CLI version
      id: infisical-version
      shell: bash
      run: |
        echo "🔍 Fetching latest valid Infisical CLI version..."
        
        # Fetch all releases (up to 30 most recent)
        JSON=$(curl -s "https://api.github.com/repos/Infisical/cli/releases?per_page=100")
        
        # Check if we got a valid response
        if [[ "$JSON" == "null" || -z "$JSON" || "$JSON" == "[]" ]]; then
          echo "❌ Failed to fetch releases from GitHub API"
          echo "Response: $JSON"
          echo "FETCH_FAILED=true" >> $GITHUB_ENV
          exit 1
        fi
    
        ARCH="linux_amd64"
        FOUND_VERSION=""
        FOUND_TAG=""
    
        # Find the first release that matches our criteria:
        # 1. Tag name starts with "v"
        # 2. Tag name does not contain "-postgres"
        # 3. Is not a prerelease
        # 4. Is not a draft
        # 5. Has the expected CLI asset for this architecture
        while IFS= read -r TAG_NAME; do
          # Extract version from tag (remove "v" prefix)
          VERSION=$(echo "$TAG_NAME" | sed 's|v||')
          ASSET="cli_${VERSION}_${ARCH}.tar.gz"
    
          # Check if the release actually contains the expected asset
          HAS_ASSET=$(echo "$JSON" | jq -r --arg tag "$TAG_NAME" --arg asset "$ASSET" '
            .[] | select(.tag_name == $tag) | .assets[] | select(.name == $asset) | .name
          ')
    
          if [[ -n "$HAS_ASSET" ]]; then
            echo "✅ Found release $TAG_NAME with asset $ASSET"
            FOUND_VERSION="$VERSION"
            FOUND_TAG="$TAG_NAME"
            break
          else
            echo "⚠️  Release $TAG_NAME does not have asset $ASSET, skipping..."
          fi
        done < <(echo "$JSON" | jq -r '
          .[] | 
          select(.draft == false) |
          select(.prerelease == false) |
          select(.tag_name | startswith("v")) |
          select(.tag_name | contains("-postgres") | not) |
          .tag_name |
          select(. != null)
        ')
        
        # Check if we found a valid tag
        if [[ -z "$FOUND_VERSION" || -z "$FOUND_TAG" ]]; then
          echo "❌ No valid Infisical CLI release found with the expected asset"
          echo "Available releases:"
          echo "$JSON" | jq -r '.[] | select(.draft == false) | .tag_name' | head -10
          echo "FETCH_FAILED=true" >> $GITHUB_ENV
          exit 1
        fi
        
        echo "🔍 Found valid CLI version: $FOUND_VERSION (tag: $FOUND_TAG)"
        echo "version=$FOUND_VERSION" >> "$GITHUB_OUTPUT"
        echo "tag_name=$FOUND_TAG" >> "$GITHUB_OUTPUT"
        echo "FETCH_FAILED=false" >> $GITHUB_ENV
    - name: Cache Infisical CLI
      uses: actions/cache@v5
      id: infisical-cache
      if: env.FETCH_FAILED != 'true'
      with:
        path: .tools/infisical
        key: ${{ runner.os }}-infisical-v${{ steps.infisical-version.outputs.version }}

    - name: Install Infisical CLI if needed
      if: env.FETCH_FAILED != 'true' && steps.infisical-cache.outputs.cache-hit != 'true'
      shell: bash
      run: |
        VERSION=${{ steps.infisical-version.outputs.version }}
        TAG_NAME=${{ steps.infisical-version.outputs.tag_name }}
        ASSET="cli_${VERSION}_linux_amd64.tar.gz"
        # URL encode the tag name for the download URL
        ENCODED_TAG=$(echo "$TAG_NAME" | sed 's|/|%2F|g')
        URL="https://github.com/Infisical/cli/releases/download/$ENCODED_TAG/$ASSET"

        echo "⬇️ Downloading Infisical CLI $VERSION from $URL"
        mkdir -p .tools/infisical
        
        # Download and verify
        if ! curl -sL "$URL" | tar -xz -C .tools/infisical; then
          echo "❌ Failed to download or extract Infisical CLI"
          echo "❌ URL attempted: $URL"
          echo "❌ Asset expected: $ASSET"
          echo "INSTALL_FAILED=true" >> $GITHUB_ENV
          exit 1
        fi
        
        chmod +x .tools/infisical/infisical
        echo "✅ Infisical CLI installed successfully"
        echo "INSTALL_FAILED=false" >> $GITHUB_ENV

    - name: Add Infisical to PATH
      shell: bash
      if: env.FETCH_FAILED != 'true' && env.INSTALL_FAILED != 'true'
      run: echo "$GITHUB_WORKSPACE/.tools/infisical" >> $GITHUB_PATH

    - name: Install tools
      shell: bash
      if: env.FETCH_FAILED != 'true' && env.INSTALL_FAILED != 'true'
      run: |
        version=$(pip show pip | grep Version: | cut -d' ' -f2)
        lower=$(printf "23.1\n$version" | sort -V | head -n1)
        if [ "$lower" == "23.1" ]; then
          pip install csvkit --break-system-packages
        else
          pip install csvkit
        fi
        npm install -g csv-to-markdown-table

    - name: Run scan
      shell: bash
      if: env.FETCH_FAILED != 'true' && env.INSTALL_FAILED != 'true'
      run: |
        echo "🔍 Running Infisical secrets scan..."
        if infisical scan --redact -f csv -r secrets-result-raw.csv 2>&1 | tee >(sed -r 's/\x1b\[[0-9;]*m//g' >secrets-result.log); then
          echo "SCAN_SUCCESS=true" >> $GITHUB_ENV
        else
          echo "SCAN_SUCCESS=false" >> $GITHUB_ENV
          # Even if scan fails, we want to continue to check if it was due to secrets found
        fi

    - name: Check scan results and generate report
      shell: bash
      if: always() && env.FETCH_FAILED != 'true' && env.INSTALL_FAILED != 'true'
      run: |
        # Check if scan actually ran and produced results
        if [[ -f "secrets-result.log" ]]; then
          echo "SCAN_RAN=true" >> $GITHUB_ENV
          
          # Check if secrets were found (file exists and has content)
          if [[ -s "secrets-result-raw.csv" ]]; then
            echo "SECRETS_FOUND=true" >> $GITHUB_ENV
            echo "🚨 Secrets detected, generating report..."
            
            # Process the CSV file
            csvformat -M $'\r' secrets-result-raw.csv | sed -e ':a' -e 'N;$!ba' -e 's/\n/\\n/g' | tr '\r' '\n' > secrets.csv
            head -n 11 < secrets.csv > secrets-result.csv
            csv-to-markdown-table --delim , --headers < secrets-result.csv > secrets-result.md
            awk -F, '{print $(NF-2)}' < secrets.csv | tail -n +2 > fingerprint.txt
          else
            echo "SECRETS_FOUND=false" >> $GITHUB_ENV
            echo "✅ No secrets detected"
          fi
        else
          echo "SCAN_RAN=false" >> $GITHUB_ENV
          echo "❌ Scan did not run properly - no log file generated"
        fi

    - name: Count secrets leaked
      shell: bash
      if: always()
      id: count
      run: |
        quantity=0
        if [[ -s fingerprint.txt ]]; then
            quantity=$(wc -l < fingerprint.txt)
        fi
        echo "secrets-leaked=$quantity" >> $GITHUB_OUTPUT

    - name: Upload artifacts secrets-result.log
      uses: actions/upload-artifact@v7
      if: always() && env.SCAN_RAN == 'true'
      with:
        name: report-log
        path: secrets-result.log

    - name: Upload artifacts secrets.csv
      uses: actions/upload-artifact@v7
      if: env.SECRETS_FOUND == 'true'
      id: secrets
      with:
        name: secrets-csv
        path: secrets.csv

    - name: Upload artifacts secrets-result.csv
      uses: actions/upload-artifact@v7
      if: env.SECRETS_FOUND == 'true'
      with:
        name: report-csv
        path: secrets-result.csv

    - name: Upload artifacts secrets-result.md
      uses: actions/upload-artifact@v7
      if: env.SECRETS_FOUND == 'true'
      with:
        name: report-md
        path: secrets-result.md

    - name: Upload artifacts fingerprint.txt
      uses: actions/upload-artifact@v7
      if: env.SECRETS_FOUND == 'true'
      with:
        name: fingerprint-txt
        path: fingerprint.txt

    - name: Read secrets-result.log
      uses: guibranco/github-file-reader-action-v2@v2.3.2
      if: always() && env.SCAN_RAN == 'true'
      id: log
      with:
        path: secrets-result.log

    - name: Read secrets-result.md
      uses: guibranco/github-file-reader-action-v2@v2.3.2
      if: env.SECRETS_FOUND == 'true'
      id: report
      with:
        path: secrets-result.md

    - name: Read fingerprint.txt
      uses: guibranco/github-file-reader-action-v2@v2.3.2
      if: env.SECRETS_FOUND == 'true'
      id: fingerprint
      with:
        path: fingerprint.txt

    - name: Check if .infisicalignore exists
      id: ignorefile
      shell: bash
      if: env.SECRETS_FOUND == 'true'
      run: |
        if [[ -f ".infisicalignore" ]]; then
          echo "exists=true" >> $GITHUB_OUTPUT
        else
          echo "exists=false" >> $GITHUB_OUTPUT
        fi

    - name: Prepare ignore file suggestion
      id: ignore_suggestion
      shell: bash
      if: env.SECRETS_FOUND == 'true'
      run: |
        echo "Preparing suggestion block..."

        if [[ "${{ steps.ignorefile.outputs.exists }}" == "true" ]]; then
          echo "Appending fingerprints to existing .infisicalignore"
          cat .infisicalignore > new-ignorefile.txt
          echo "" >> new-ignorefile.txt
          cat fingerprint.txt >> new-ignorefile.txt
        else
          echo "Creating new .infisicalignore"
          cat fingerprint.txt > new-ignorefile.txt
        fi

        # Remove duplicates (optional improvement)
        sort -u new-ignorefile.txt -o new-ignorefile.txt

        echo "suggestion<<EOF" >> $GITHUB_OUTPUT
        echo '```suggestion:.infisicalignore' >> $GITHUB_OUTPUT
        cat new-ignorefile.txt >> $GITHUB_OUTPUT
        echo '```' >> $GITHUB_OUTPUT
        echo "EOF" >> $GITHUB_OUTPUT
    
    - name: Create review suggestion for .infisicalignore
      uses: actions/github-script@v7
      if: env.SECRETS_FOUND == 'true' && env.FORKED == 'false' && inputs.ADD_COMMENT == 'true'
      with:
        github-token: ${{ inputs.GH_TOKEN }}
        script: |

          const fs = require('fs');

          const suggestion =
            fs.readFileSync('new-ignorefile.txt', 'utf8');

          const suggestionBlock =
            "```suggestion:.infisicalignore\n" +
            suggestion +
            "\n```";

          const pr = context.payload.pull_request;

          if (!pr) {
            core.info("Not a PR event — skipping review suggestion.");
            return;
          }

          await github.rest.pulls.createReview({
            owner: context.repo.owner,
            repo: context.repo.repo,
            pull_number: pr.number,
            event: "COMMENT",
            body:
              "### Suggested update for `.infisicalignore`\n\n" +
              "Apply this suggestion to ignore detected fingerprints:\n\n" +
              suggestionBlock
          });

          core.info("Review suggestion posted successfully.");    
    
    - name: Update PR with comment (success)
      uses: mshick/add-pr-comment@v3
      if: env.SCAN_RAN == 'true' && env.SECRETS_FOUND == 'false' && env.FORKED == 'false' && inputs.ADD_COMMENT == 'true'
      with:
        repo-token: ${{ inputs.GH_TOKEN }}
        refresh-message-position: true
        message-id: "secrets-result"
        message: |
          **Infisical secrets check:** ✅ No secrets leaked!

          <details>
            <summary>💻 Scan logs</summary>
            
            ```txt
            ${{ steps.log.outputs.contents }}
            ```
          </details>

    - name: Update PR with comment (failure - secrets found)
      uses: mshick/add-pr-comment@v3
      if: env.SECRETS_FOUND == 'true' && env.FORKED == 'false' && inputs.ADD_COMMENT == 'true'
      with:
        repo-token: ${{ inputs.GH_TOKEN }}
        refresh-message-position: true
        message-id: "secrets-result"
        message: |
          **Infisical secrets check:** 🚨 Secrets leaked!

          > [!CAUTION]
          > The Infisical CLI tool found secrets leaked in your repository.
          > Please review the scan results and take the necessary actions.
          > Secrets found: ${{ steps.count.outputs.secrets-leaked }}

          <details>
            <summary>💻 Scan logs</summary>
            
            ```txt
            ${{ steps.log.outputs.contents }}
            ```
          </details>

          ---

          <details>
            <summary>🔎 Detected secrets in your GIT history</summary>

            ${{ steps.report.outputs.contents }}

          </details>

          > [!WARNING] 
          > The above table only displays the first 10 leaked secrets.
          > You can find the full report here: [secrets.csv](${{ steps.secrets.outputs.artifact-url }})

          ---

          <details>
            <summary>🐾 Secrets fingerprint</summary>
            
            ```txt
            ${{ steps.fingerprint.outputs.contents }}
            ```
          </details>

          > [!TIP]
          > If you want to ignore these leaked secrets, add the above **fingerprint** content to a file named `.infisicalignore` at the repository root level.

    - name: Update PR with comment (tool failure)
      uses: mshick/add-pr-comment@v3
      if: (env.FETCH_FAILED == 'true' || env.INSTALL_FAILED == 'true' || env.SCAN_RAN == 'false') && env.FORKED == 'false' && inputs.ADD_COMMENT == 'true'
      with:
        repo-token: ${{ inputs.GH_TOKEN }}
        refresh-message-position: true
        message-id: "secrets-result"
        message: |
          **Infisical secrets check:** ⚠️ Tool failure - Unable to complete scan!

          > [!WARNING]
          > The Infisical secrets scan could not be completed due to a tool failure.
          > This may be due to:
          > - GitHub API rate limiting when fetching the latest CLI version
          > - Network issues during CLI download
          > - CLI execution problems
          
          **What to do:**
          1. **Re-run the workflow** - This is often a temporary issue
          2. Check the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for specific error details
          3. If the issue persists, please report it to the action maintainer

          > [!NOTE]
          > This failure does **not** mean secrets were found - the scan simply couldn't run.

    - name: Update PR with comment (cancelled)
      uses: mshick/add-pr-comment@v3
      if: cancelled() && env.FORKED == 'false' && inputs.ADD_COMMENT == 'true'
      with:
        repo-token: ${{ inputs.GH_TOKEN }}
        refresh-message-position: true
        message-id: "secrets-result"
        message: |
          **Infisical secrets check:** ⭕ Secrets check cancelled!

    - name: Fail workflow if secrets found
      shell: bash
      if: env.SECRETS_FOUND == 'true'
      run: |
        echo "❌ Failing workflow due to secrets found"
        exit 1

    - name: Fail workflow if tool failed
      shell: bash
      if: env.FETCH_FAILED == 'true' || env.INSTALL_FAILED == 'true' || env.SCAN_RAN == 'false'
      run: |
        echo "❌ Failing workflow due to tool failure"
        exit 1