# Secret Scanner Action

Scan your codebase for hardcoded secrets in GitHub Actions.

Source: https://keyenv.dev/docs/sdks/scan-action/

Scan your codebase for hardcoded secrets before they reach production. This GitHub Action integrates KeyEnv's secret scanning directly into your CI/CD pipeline.

## Features

- Detect API keys, tokens, passwords, and other secrets
- 149+ patterns covering major providers (AWS, GitHub, Stripe, etc.)
- Configurable severity thresholds
- Cross-platform support (Linux, macOS)
- Optional upload to KeyEnv dashboard
- JSON output for downstream processing

## Basic Usage

Add to your workflow to scan for secrets on every push:

```yaml
name: Security Scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Scan for secrets
        uses: keyenv/scan-action@v1
```

## Inputs

| Input | Description | Required | Default |
|-------|-------------|----------|---------|
| `severity` | Minimum severity to fail (`critical`, `high`, `medium`, `low`) | No | `medium` |
| `path` | Path to scan | No | `.` |
| `upload` | Upload results to KeyEnv dashboard | No | `false` |
| `token` | KeyEnv service token (required if upload is true) | No | - |
| `version` | KeyEnv CLI version to use | No | `latest` |

## Outputs

| Output | Description |
|--------|-------------|
| `findings-count` | Number of secrets found |
| `findings-json` | JSON object containing all findings and summary |

## Examples

### Custom Severity Threshold

Only fail on critical and high severity findings:

```yaml
- name: Scan for secrets
  uses: keyenv/scan-action@v1
  with:
    severity: high
```

### Scan Specific Directory

Scan only a specific directory:

```yaml
- name: Scan for secrets
  uses: keyenv/scan-action@v1
  with:
    path: ./src
    severity: medium
```

### Upload to KeyEnv Dashboard

Upload scan results to your KeyEnv dashboard for tracking and reporting:

```yaml
- name: Scan for secrets
  uses: keyenv/scan-action@v1
  with:
    upload: true
    token: ${{ secrets.KEYENV_TOKEN }}
```

### Use Findings in Subsequent Steps

Access scan results in downstream steps:

```yaml
- name: Scan for secrets
  id: scan
  uses: keyenv/scan-action@v1
  continue-on-error: true

- name: Process results
  if: steps.scan.outputs.findings-count > 0
  run: |
    echo "Found ${{ steps.scan.outputs.findings-count }} secrets"
    echo "${{ steps.scan.outputs.findings-json }}" | jq '.findings[]'
```

### Pin to Specific CLI Version

Use a specific version of the KeyEnv CLI:

```yaml
- name: Scan for secrets
  uses: keyenv/scan-action@v1
  with:
    version: v0.5.0
```

## Complete Workflow Example

```yaml
name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  secret-scan:
    name: Secret Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for better detection

      - name: Scan for secrets
        id: scan
        uses: keyenv/scan-action@v1
        with:
          severity: high
          upload: true
          token: ${{ secrets.KEYENV_TOKEN }}

      - name: Comment on PR
        if: failure() && github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '## Secret Scan Failed\n\nSecrets were detected in this PR. Please remove them before merging.\n\nFound: ${{ steps.scan.outputs.findings-count }} secrets'
            })
```

## Severity Levels

- **critical**: Highly sensitive secrets (production API keys, private keys)
- **high**: Sensitive credentials (database passwords, OAuth tokens)
- **medium**: Potentially sensitive data (internal API keys)
- **low**: Low-risk findings (generic patterns that may be false positives)

## What Gets Detected

The scanner detects secrets from:

| Category | Examples |
|----------|----------|
| Cloud Providers | AWS access keys, GCP service accounts, Azure credentials |
| Version Control | GitHub PATs, GitLab tokens, Bitbucket app passwords |
| AI Services | OpenAI, Anthropic, Google AI API keys |
| Payments | Stripe, PayPal, Square API keys |
| Communication | Slack, Discord, Telegram tokens |
| Databases | Connection strings, MongoDB URIs, Redis passwords |
| Infrastructure | Terraform tokens, Kubernetes secrets, SSH keys |
| Generic | JWT tokens, API keys, passwords in URLs |

## Best Practices

1. **Run on pull requests**: Catch secrets before they're merged
2. **Use `severity: high`**: Reduce false positives in CI
3. **Upload results**: Track security trends over time
4. **Store tokens securely**: Use GitHub Secrets for your KeyEnv token
5. **Block merges**: Use required status checks to prevent secret leaks

## Difference from keyenv-action

KeyEnv provides two GitHub Actions:

| Action | Purpose |
|--------|---------|
| `keyenv/keyenv-action` | **Fetch secrets** - Inject KeyEnv secrets into your workflow |
| `keyenv/scan-action` | **Find secrets** - Scan for hardcoded secrets in your codebase |

Use them together for comprehensive secret management:

```yaml
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      # First, scan for any hardcoded secrets
      - uses: actions/checkout@v4
      - uses: keyenv/scan-action@v1
        with:
          severity: high

  deploy:
    needs: security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Then, inject managed secrets for deployment
      - uses: keyenv/keyenv-action@v1
        with:
          token: ${{ secrets.KEYENV_TOKEN }}
          environment: production
      - run: ./deploy.sh
```