Repository navigation
Use Echo Go proxy in CI workflows(AST-189161) - #1599
Conversation
Configure GOPROXY with the Echo Libraries access key across test, lint, vulnerability scan, Trivy, and release workflows. Require the key for reusable release workflow calls.
Original alert (resolved)Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-atish-jadhav) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-atish-jadhav) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-atish-jadhav) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-atish-jadhav) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-atish-jadhav) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
|
| Secret Type | Status | Commit | File Path | View |
|---|---|---|---|---|
| URI | 0996fc220b |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 0996fc220b |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 0996fc220b |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 0996fc220b |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 0996fc220b |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 0996fc220b |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 6fb5248d7e |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 6fb5248d7e |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 6fb5248d7e |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 6fb5248d7e |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 6fb5248d7e |
internal/commands/gitmetadata_test.go |
🔎 View secret | |
| URI | 6fb5248d7e |
internal/commands/gitmetadata_test.go |
🔎 View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Immediately rotate/revoke the exposed secret. (https://howtorotate.com/docs/introduction/getting-started/)
- Remove it from git history ( a new "remove secret" commit is NOT enough e.g. with
git-filter-repo).
To avoid such incidents in the future consider:
- Following the best practices for managing and storing secrets, including API keys and other credentials.
- Re-scan after cleanup before merging.
⚠️ These are unverified matches and do not block the merge — please review and confirm they are not real secrets.
Refresh the Checkmarx Bash base image and upgrade KICS from v2.1.20 to v2.2.0 for scans and remediation. Remove the ignore entry for the base-image vulnerability.
Configure GOPROXY with the Echo Libraries access key across test, lint, vulnerability scan, Trivy, and release workflows. Require the key for reusable release workflow calls.
By submitting this pull request, you agree to the terms within the Checkmarx Code of Conduct. Please review the contributing guidelines for guidance on creating high-quality pull requests.
Description
Please provide a summary of the changes and the related issue. Include relevant motivation and context.
Type of Change
Related Issues
Link any related issues or tickets.
Checklist
Screenshots (if applicable)
Add screenshots to help explain your changes.
Additional Notes
Add any other relevant information.