Skip to content

Commit c91fd9e

Browse files
mickeygoussetjoshjohanning
mickeygousset
and
joshjohanning
authored
Secret Scanning Scripts - List Resolved Alerts and Change Resolved Alerts Back to Open (#97)
* checks commit sizes for entire repo and specific hash * feat: add descriptions for git-commit-analyzer.sh and git-repo-commit-analyzer.sh scripts * feat: add scripts to manage GitHub secret scanning alerts * docs: add secret scanning scripts to readme --------- Co-authored-by: Josh Johanning <[email protected]>
1 parent b22658c commit c91fd9e

File tree

3 files changed

+230
-0
lines changed

3 files changed

+230
-0
lines changed

‎scripts/README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,10 @@ Docs:
7878
- [Generating an installation access token for a GitHub App](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token)
7979
- [List installations for the authenticated app](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#list-installations-for-the-authenticated-app)
8080

81+
## get-list-of-resolved-secret-scanning-alerts.sh
82+
83+
This script retrieves and lists all resolved secret scanning alerts for a specified GitHub repository. It uses the GitHub API to fetch the alerts and displays them in a tabular format.
84+
8185
## get-new-outside-collaborators-added-to-repository.sh
8286

8387
This script will generate a list of new outside collaborators added to a repository. It uses a database file specified to determine if any new users were added to the repository and echo them to the console for review.
@@ -135,6 +139,10 @@ These are scripts used with [`multi-gitter`](https://github.com/lindell/multi-gi
135139

136140
See: [recreate-security-in-repositories-and-teams](./recreate-security-in-repositories-and-teams/README.md)
137141

142+
## set-secret-scanning-alert-to-open-state.sh
143+
144+
This script reopens a resolved secret scanning alert in a specified GitHub repository and optionally adds a comment.
145+
138146
## update-codeowners-mappings.js
139147

140148
Update CODEOWNERS mappings of teams in a GitHub repository (e.g.: after a migration if the team/org names change). This script will update the CODEOWNERS file in a GitHub repository with the mappings provided in the `codeowners-mappings.csv` file.

‎scripts/get-list-of-resolved-secret-scanning-alerts.sh

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
#!/bin/bash
2+
3+
# -----------------------------------------------------------------------------
4+
# Script Name: get-list-of-resolved-secret-scanning-alerts.sh
5+
# Description: This script retrieves and lists all resolved secret scanning
6+
# alerts for a specified GitHub repository. It uses the GitHub API
7+
# to fetch the alerts and displays them in a tabular format.
8+
#
9+
# Usage:
10+
# ./get-list-of-resolved-secret-scanning-alerts.sh -o <organization> -r <repository> [-t <token>]
11+
#
12+
# Parameters:
13+
# -o <organization> GitHub organization name (required)
14+
# -r <repository> GitHub repository name (required)
15+
# -t <token> GitHub personal access token (optional, will use GITHUB_TOKEN
16+
# environment variable if not provided)
17+
# -h Display help message
18+
#
19+
# Requirements:
20+
# - curl: Command-line tool for making HTTP requests
21+
# - jq: Command-line JSON processor
22+
#
23+
# Notes:
24+
# - The script supports pagination to handle repositories with a large number
25+
# of resolved alerts.
26+
# - The GitHub token must have the necessary permissions to access secret
27+
# scanning alerts for the specified repository.
28+
# -----------------------------------------------------------------------------
29+
30+
# Function to display usage information
31+
function display_usage {
32+
echo "Usage: $0 -o <organization> -r <repository> [-t <token>]"
33+
echo " -o <organization> GitHub organization name"
34+
echo " -r <repository> GitHub repository name"
35+
echo " -t <token> GitHub personal access token (optional, will use GITHUB_TOKEN env var if not provided)"
36+
echo " -h Display this help message"
37+
exit 1
38+
}
39+
40+
# Parse command line arguments
41+
while getopts "o:r:t:h" opt; do
42+
case ${opt} in
43+
o ) org_name=$OPTARG ;; # GitHub organization name
44+
r ) repo_name=$OPTARG ;; # GitHub repository name
45+
t ) github_token=$OPTARG ;; # GitHub personal access token
46+
h ) display_usage ;; # Display help message
47+
\? ) display_usage ;; # Handle invalid options
48+
esac
49+
done
50+
51+
# Check if required parameters are provided
52+
if [ -z "$org_name" ] || [ -z "$repo_name" ]; then
53+
echo "Error: Organization name and repository name are required."
54+
display_usage
55+
fi
56+
57+
# If token not provided as argument, try to use GITHUB_TOKEN environment variable
58+
if [ -z "$github_token" ]; then
59+
github_token=$GITHUB_TOKEN
60+
if [ -z "$github_token" ]; then
61+
echo "Error: GitHub token not provided. Either provide it with -t option or set the GITHUB_TOKEN environment variable."
62+
exit 1
63+
fi
64+
fi
65+
66+
# Set API URL for secret scanning alerts with state=resolved
67+
api_url="https://api.github.com/repos/$org_name/$repo_name/secret-scanning/alerts?state=resolved&per_page=100"
68+
page=1
69+
total_alerts=0
70+
71+
# Display header for the output table
72+
echo "Retrieving resolved secret scanning alerts for $org_name/$repo_name..."
73+
echo "--------------------------------------------------------------------"
74+
echo "| Alert ID | Created At | Resolved At | Secret Type | Resolution |"
75+
echo "--------------------------------------------------------------------"
76+
77+
# Loop through paginated results
78+
while true; do
79+
# Make API request
80+
response=$(curl -s -H "Authorization: token $github_token" \
81+
-H "Accept: application/vnd.github.v3+json" \
82+
-H "X-GitHub-Api-Version: 2022-11-28" \
83+
"$api_url&page=$page")
84+
85+
# Check if response contains error
86+
if echo "$response" | grep -q "message"; then
87+
error_message=$(echo "$response" | grep -o '"message":"[^"]*' | cut -d'"' -f4)
88+
echo "Error: $error_message"
89+
exit 1
90+
fi
91+
92+
# Check if response is empty array
93+
if [ "$response" = "[]" ]; then
94+
break
95+
fi
96+
97+
# Count the number of alerts in this page and add to total
98+
page_alerts=$(echo "$response" | jq '. | length')
99+
total_alerts=$((total_alerts + page_alerts))
100+
101+
# Process and display alerts
102+
echo "$response" | jq -r '.[] | [.number, .created_at, .resolved_at, .secret_type, .resolution] | @tsv' |
103+
while read -r alert_id created_at resolved_at secret_type resolution; do
104+
# Format dates for better readability
105+
created_date=$(date -d "$created_at" "+%Y-%m-%d %H:%M" 2>/dev/null || echo "$created_at")
106+
resolved_date=$(date -d "$resolved_at" "+%Y-%m-%d %H:%M" 2>/dev/null || echo "$resolved_at")
107+
108+
printf "| %-8s | %-19s | %-19s | %-20s | %-10s |\n" \
109+
"$alert_id" "$created_date" "$resolved_date" "$secret_type" "$resolution"
110+
done
111+
112+
# Check if there are more pages
113+
link_header=$(curl -s -I -H "Authorization: token $github_token" \
114+
-H "Accept: application/vnd.github.v3+json" \
115+
-H "X-GitHub-Api-Version: 2022-11-28" \
116+
"$api_url&page=$page" | grep -i "link:")
117+
118+
if ! echo "$link_header" | grep -q 'rel="next"'; then
119+
break
120+
fi
121+
122+
((page++))
123+
done
124+
125+
# Display footer and total count
126+
echo "--------------------------------------------------------------------"
127+
echo "Total resolved secret scanning alerts found: $total_alerts"
128+
echo ""
129+
echo "Note: This script requires 'curl' and 'jq' to be installed."

‎scripts/set-secret-scanning-alert-to-open-state.sh

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/bin/bash
2+
3+
# -----------------------------------------------------------------------------
4+
# Script Name: set-secret-scanning-alert-to-open-state.sh
5+
# Description: This script reopens a resolved secret scanning alert in a
6+
# specified GitHub repository and optionally adds a comment.
7+
#
8+
# Usage:
9+
# ./set-secret-scanning-alert-to-open-state.sh -o <organization> -r <repository> -a <alert_id> [-c <comment>] [-t <token>]
10+
#
11+
# Parameters:
12+
# -o <organization> GitHub organization name (required)
13+
# -r <repository> GitHub repository name (required)
14+
# -a <alert_id> Secret scanning alert ID (required)
15+
# -c <comment> Comment to add when reopening the alert (optional)
16+
# -t <token> GitHub personal access token (optional, will use GITHUB_TOKEN
17+
# environment variable if not provided)
18+
# -h Display help message
19+
#
20+
# Requirements:
21+
# - curl: Command-line tool for making HTTP requests
22+
# - jq: Command-line JSON processor
23+
#
24+
# Notes:
25+
# - The GitHub token must have the necessary permissions to update secret
26+
# scanning alerts for the specified repository.
27+
# -----------------------------------------------------------------------------
28+
29+
# Function to display usage information
30+
function display_usage {
31+
echo "Usage: $0 -o <organization> -r <repository> -a <alert_id> [-c <comment>] [-t <token>]"
32+
echo " -o <organization> GitHub organization name"
33+
echo " -r <repository> GitHub repository name"
34+
echo " -a <alert_id> Secret scanning alert ID"
35+
echo " -c <comment> Comment to add when reopening the alert (optional)"
36+
echo " -t <token> GitHub personal access token (optional, will use GITHUB_TOKEN env var if not provided)"
37+
echo " -h Display this help message"
38+
exit 1
39+
}
40+
41+
# Parse command line arguments
42+
while getopts "o:r:a:c:t:h" opt; do
43+
case ${opt} in
44+
o ) org_name=$OPTARG ;; # GitHub organization name
45+
r ) repo_name=$OPTARG ;; # GitHub repository name
46+
a ) alert_id=$OPTARG ;; # Secret scanning alert ID
47+
c ) comment=$OPTARG ;; # Optional comment
48+
t ) github_token=$OPTARG ;; # GitHub personal access token
49+
h ) display_usage ;; # Display help message
50+
\? ) display_usage ;; # Handle invalid options
51+
esac
52+
done
53+
54+
# Check if required parameters are provided
55+
if [ -z "$org_name" ] || [ -z "$repo_name" ] || [ -z "$alert_id" ]; then
56+
echo "Error: Organization name, repository name, and alert ID are required."
57+
display_usage
58+
fi
59+
60+
# If token not provided as argument, try to use GITHUB_TOKEN environment variable
61+
if [ -z "$github_token" ]; then
62+
github_token=$GITHUB_TOKEN
63+
if [ -z "$github_token" ]; then
64+
echo "Error: GitHub token not provided. Either provide it with -t option or set the GITHUB_TOKEN environment variable."
65+
exit 1
66+
fi
67+
fi
68+
69+
# Set API URL for the specific secret scanning alert
70+
api_url="https://api.github.com/repos/$org_name/$repo_name/secret-scanning/alerts/$alert_id"
71+
72+
# Make API request to update the alert's state to "open"
73+
response=$(curl -s -X PATCH -H "Authorization: token $github_token" \
74+
-H "Accept: application/vnd.github.v3+json" \
75+
-H "X-GitHub-Api-Version: 2022-11-28" \
76+
-d "{\"state\": \"open\", \"resolution_comment\": \"$comment\"}" \
77+
"$api_url")
78+
79+
# Check if the response contains an error
80+
if echo "$response" | grep -q "message"; then
81+
error_message=$(echo "$response" | grep -o '"message":"[^"]*' | cut -d'"' -f4)
82+
echo "Error: $error_message"
83+
exit 1
84+
fi
85+
86+
# Confirm the state change
87+
new_state=$(echo "$response" | jq -r '.state')
88+
if [ "$new_state" == "open" ]; then
89+
echo "Success: Secret scanning alert $alert_id has been changed to 'open'."
90+
else
91+
echo "Error: Failed to change the state of alert $alert_id to 'open'."
92+
exit 1
93+
fi

0 commit comments

Comments
 (0)