@prism-d1/cli 1.0.93 → 1.0.95

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -7,6 +7,11 @@
 #   - .kiro/steering/code-review.md in your repo (review rules)
 #   - (Optional) PRISM_METRICS_ROLE_ARN for EventBridge metrics emission
 #   - (Optional) AWS Continuum configured for security scanning
+#
+# Secret scanning (gitleaks) needs no setup and no secret. It installs itself
+# and always runs, so it is the only gate that still functions on a fork PR.
+# Tune it with an optional .gitleaks.toml (allowlists) at the repo root, or
+# .prism/gitleaks-baseline.json to adopt the gate on a repo with known findings.
 
 name: PRISM Eval Gate
 
@@ -38,7 +43,174 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Secret scanning runs FIRST -- ahead of the Kiro CLI install, the review,
+      # and the Continuum scan.
+      #
+      # Order is load-bearing, not cosmetic. `Install Kiro CLI` pipes curl into
+      # bash with no failure guard, so a network blip or an unsupported glibc
+      # there aborts the job. Behind it, the secret scan would never run -- and
+      # the one gate that needs no secret would be the one taken out by an
+      # unrelated optional install. It also means a committed credential does not
+      # wait behind a model call to surface.
+      #
+      # It also never skips, which is deliberately unlike the two gates below.
+      # Those skip for structural reasons: fork PRs cannot receive secrets, so
+      # KIRO_API_KEY is genuinely absent, and Continuum may simply not be
+      # deployed. Neither applies here -- gitleaks needs no secret and no AWS
+      # role, and this workflow installs the binary itself, so "unavailable"
+      # is an install failure rather than a deployment choice. Every failure
+      # path below therefore fails closed. A secret scanner that reports green
+      # without having scanned is worse than no scanner, because it launders a
+      # leak into a passing check.
+      #
+      # Needing no secret is also why this is the one gate with teeth on a fork
+      # PR -- exactly where an untrusted contributor might push a credential.
+      - name: Install gitleaks
+        id: gitleaks-install
+        env:
+          # Pinned deliberately. Floating to latest would let an upstream
+          # release change what this gate blocks without a repo change.
+          GITLEAKS_VERSION: 8.28.0
+          # SHA256 of gitleaks_8.28.0_linux_x64.tar.gz, verified out of band.
+          #
+          # Hard-pinned rather than read from the release's own checksums.txt:
+          # that file ships from the same release, so it confirms nothing if the
+          # release itself is replaced. Pinning the digest here means a swapped
+          # artifact fails the gate loudly instead of installing quietly.
+          # Bumping GITLEAKS_VERSION requires updating this value too.
+          GITLEAKS_SHA256: a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb
+        run: |
+          set -o pipefail
+          cd "${RUNNER_TEMP}"
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          URL="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${TARBALL}"
+
+          if ! curl -fsSL --retry 3 --retry-delay 2 -o "${TARBALL}" "${URL}"; then
+            echo "::error::Could not download gitleaks ${GITLEAKS_VERSION} -- this PR has NOT been secret-scanned."
+            echo "error=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if ! echo "${GITLEAKS_SHA256}  ${TARBALL}" | sha256sum -c -; then
+            echo "::error::gitleaks checksum mismatch -- refusing to install an unverified binary."
+            echo "  Expected ${GITLEAKS_SHA256}"
+            echo "  If you just bumped GITLEAKS_VERSION, update GITLEAKS_SHA256 to match."
+            echo "error=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          tar -xzf "${TARBALL}" gitleaks
+          install -m 0755 gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+
+      - name: Scan for committed secrets (gitleaks)
+        id: gitleaks
+        if: steps.gitleaks-install.outputs.error != 'true'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          REPORT="${RUNNER_TEMP}/gitleaks-report.json"
+
+          if [ -z "${BASE_SHA}" ] || [ -z "${HEAD_SHA}" ]; then
+            echo "::error::Missing base/head SHA -- cannot determine what to scan, failing closed."
+            echo "error=true" >> "$GITHUB_OUTPUT"
+            echo "leaks=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Scope is the commits this PR introduces, NOT the whole history.
+          #
+          # A full-history scan on every PR re-reports every secret that predates
+          # the gate, so the gate can never go green and gets switched off within
+          # a week. Pre-existing leaks need a one-time `gitleaks git` sweep plus
+          # a credential rotation -- work an unrelated PR cannot do and should
+          # not be blocked on.
+          #
+          # --redact is load-bearing: without it gitleaks prints the matched
+          # secret into the build log, which is public on a public repo. That
+          # would turn the scanner into a second disclosure channel for the
+          # thing it just found.
+          #
+          # Smoke-testing this gate: verify your fixture with gitleaks itself
+          # before trusting a green result. A hand-written fake credential can
+          # look completely plausible to a human and still match no rule, in
+          # which case "no leaks found" is correct and the gate only appears
+          # broken. Never infer that from the rule internals -- they are version
+          # specific and change without notice. Ask the tool:
+          #
+          #   gitleaks dir /path/to/fixture --redact --no-banner -v
+          #
+          # A non-zero finding count there is the only evidence the fixture is
+          # usable. Two known traps it will surface for you: gitleaks' defaults
+          # allowlist AWS's own documentation keys (AKIAIOSFODNN7EXAMPLE), and
+          # tooling that redacts credential-shaped text in transit can rewrite a
+          # key NAME out of your fixture, which disarms the rules that need a
+          # nearby keyword.
+          #
+          # A PEM block is the most robust fixture -- no charset constraints and
+          # no keyword needed -- and fires `private-key`:
+          #   printf -- '-----BEGIN RSA PRIVATE KEY-----\n%s\n-----END RSA PRIVATE KEY-----\n' \
+          #     "$(tr -dc 'A-Za-z0-9+/' </dev/urandom | head -c 64)" > id_rsa_test
+          ARGS=(git "${GITHUB_WORKSPACE}"
+                --log-opts="${BASE_SHA}..${HEAD_SHA}"
+                --report-format=json
+                --report-path="${REPORT}"
+                --redact
+                --exit-code=1
+                --no-banner)
+
+          # .gitleaks.toml at the repo root is picked up automatically and is
+          # where per-repo allowlists belong (test fixtures, example keys).
+          # A baseline lets a repo with known accepted findings adopt the gate
+          # without rewriting history first.
+          if [ -f .prism/gitleaks-baseline.json ]; then
+            ARGS+=(--baseline-path=.prism/gitleaks-baseline.json)
+            echo "Using baseline: .prism/gitleaks-baseline.json"
+          fi
+          if [ -f .gitleaks.toml ]; then
+            echo "Using repo config: .gitleaks.toml"
+          fi
+
+          set +e
+          gitleaks "${ARGS[@]}"
+          RC=$?
+          set -e
+
+          case "${RC}" in
+            0)
+              echo "✅ No secrets detected in ${BASE_SHA}..${HEAD_SHA}"
+              echo "leaks=0" >> "$GITHUB_OUTPUT"
+              ;;
+            1)
+              # Exit 1 means leaks were found. If the count cannot be read the
+              # scan still found something, so this must not degrade to 0.
+              if ! COUNT=$(jq 'length' "${REPORT}" 2>/dev/null) || [ -z "${COUNT}" ]; then
+                echo "::error::gitleaks reported findings but the report could not be parsed -- failing closed."
+                echo "error=true" >> "$GITHUB_OUTPUT"
+                echo "leaks=-1" >> "$GITHUB_OUTPUT"
+                exit 0
+              fi
+              echo "::error::gitleaks found ${COUNT} secret(s) in this PR's commits"
+              # Only safe fields are projected. The secret itself is never
+              # echoed, even though --redact already replaced it.
+              jq -r '.[] | "::error file=\(.File),line=\(.StartLine)::[\(.RuleID)] secret detected in commit \(.Commit[0:8])"' "${REPORT}" || true
+              echo "leaks=${COUNT}" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::error::gitleaks exited ${RC} -- the scan produced no verdict, so this PR is not verified."
+              echo "error=true" >> "$GITHUB_OUTPUT"
+              echo "leaks=-1" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+
+      # Only installed when the key exists. Without it the review below reports
+      # SKIPPED without ever invoking the binary, so installing it would pipe
+      # curl into bash on every fork PR for a CLI that is never called. The
+      # review step keeps its own HAS_KIRO_KEY check -- this gate is an
+      # optimisation, that one is the correctness guarantee.
       - name: Install Kiro CLI
+        if: env.HAS_KIRO_KEY == 'true'
         run: curl -fsSL https://cli.kiro.dev/install | bash
 
       - name: Read team ID
@@ -156,6 +328,9 @@ jobs:
           REVIEW_MEDIUM: ${{ steps.review.outputs.medium }}
           REVIEW_RESULT: ${{ steps.review.outputs.result }}
           REVIEW_SUMMARY: ${{ steps.review.outputs.summary }}
+          GITLEAKS_LEAKS: ${{ steps.gitleaks.outputs.leaks }}
+          GITLEAKS_ERROR: ${{ steps.gitleaks.outputs.error }}
+          GITLEAKS_INSTALL_ERROR: ${{ steps.gitleaks-install.outputs.error }}
         with:
           script: |
             const fs = require('fs');
@@ -199,6 +374,32 @@ jobs:
                 body += `> Powered by kiro-cli headless - Model: claude-haiku-4.5 - Threshold: 0.82`;
             }
 
+            // Secret scanning is reported for every result path, including the
+            // ones where the Kiro review skipped. On a fork PR the review has no
+            // API key and reports SKIPPED, so without this the comment would
+            // read as "nothing was checked" when in fact the repo WAS scanned
+            // for credentials -- the one check that still ran.
+            const gl = process.env.GITLEAKS_LEAKS;
+            const glErr = process.env.GITLEAKS_ERROR === 'true';
+            const glInstallErr = process.env.GITLEAKS_INSTALL_ERROR === 'true';
+
+            let secretLine;
+            if (glInstallErr) {
+              secretLine = '❌ **Secret scan** -- gitleaks could not be installed or verified. This PR has **not** been secret-scanned; failing closed.';
+            } else if (glErr) {
+              secretLine = '❌ **Secret scan** -- gitleaks did not produce a verdict. This PR has **not** been secret-scanned; failing closed.';
+            } else if (gl === '0') {
+              secretLine = '✅ **Secret scan** -- no credentials found in this PR\'s commits.';
+            } else if (gl) {
+              secretLine = `❌ **Secret scan** -- gitleaks found **${gl}** secret(s). See the annotations on the Files tab.\n\n` +
+                '> Rotate the exposed credential first -- removing it from the branch does not un-expose it. ' +
+                'False positive? Add an allowlist entry to `.gitleaks.toml`.';
+            } else {
+              secretLine = '⚠️ **Secret scan** -- no result reported.';
+            }
+
+            body += `\n\n---\n\n${secretLine}`;
+
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner, repo: context.repo.repo,
               issue_number: context.issue.number
@@ -257,6 +458,101 @@ jobs:
           aws events put-events --region $PRISM_AWS_REGION --entries \
             "[{\"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",\"EventBusName\":\"prism-d1-metrics\",\"Detail\":$(echo "${DETAIL}" | jq -Rs '.')}]" || true
 
+      - name: Emit gitleaks findings to EventBridge
+        if: steps.aws-creds.outcome == 'success' && steps.gitleaks.outputs.leaks != '0' && steps.gitleaks.outputs.leaks != '' && steps.gitleaks.outputs.leaks != '-1'
+        continue-on-error: true
+        env:
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
+          TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
+          REPO: ${{ env.PRISM_REPO }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          # Feeds the Team Velocity / CISO dashboards. Without this the gate
+          # blocks the PR but the exposure never reaches the metrics pipeline,
+          # so "secrets caught per 100 commits" is unanswerable.
+          #
+          # continue-on-error, and gated on findings != -1: the gate verdict is
+          # decided by the scan step, never by whether telemetry landed. A
+          # scan-error PR (findings=-1) has no findings to report.
+          REPORT="${RUNNER_TEMP}/gitleaks-report.json"
+          if [ ! -s "${REPORT}" ]; then
+            echo "No report file — nothing to emit"
+            exit 0
+          fi
+
+          # Deferred origin join, same contract as the Continuum step: emit the
+          # PR's commit SHAs as facts and let dashboards resolve AI-vs-human at
+          # render time. Attribution spans arrive on a ~12h codeburn schedule,
+          # so a verdict computed now would usually be wrong and would be baked
+          # into an immutable event.
+          COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+
+          # Severity drives real automation: prism.d1.security.code_review also
+          # routes to the security-response-automator, which on CRITICAL/HIGH
+          # writes a penalty record and fires the SecurityCriticalFinding alarm.
+          #
+          # So the mapping is deliberately fail-safe rather than uniform.
+          # gitleaks' provider-specific rules (aws-access-token, github-pat,
+          # private-key, ...) are high-confidence and page as HIGH. Its
+          # catch-all entropy rules are not: generic-api-key fired on an
+          # `aws_secret_access_key = ...` line in testing, and paging on every
+          # one of those trains people to ignore the alarm. Those report MEDIUM
+          # — still recorded, still blocking the PR via the gate, just not
+          # paging. An unrecognised NEW rule id defaults to HIGH, so the list
+          # below only ever downgrades known-noisy rules.
+          #
+          # CWE-798 = Use of Hard-coded Credentials, correct for every rule here.
+          #
+          # Fingerprint is gitleaks' own stable id (commit:file:rule:line), so
+          # re-running the workflow re-emits the same finding_id instead of
+          # inflating counts. Only safe fields are projected -- never .Secret or
+          # .Match (both already REDACTED), and never .Message, which is the
+          # commit message and could itself contain the credential.
+          ENTRIES=$(jq -c \
+            --arg team_id "${TEAM_ID}" \
+            --arg repo "${REPO}" \
+            --argjson commit_shas "${COMMIT_SHAS}" \
+            --argjson pr_number "${PR_NUMBER}" \
+            --argjson low_confidence '["generic-api-key"]' \
+            '[ .[] | . as $f | {
+                Source: "prism.d1.velocity",
+                DetailType: "prism.d1.security.code_review",
+                EventBusName: "prism-d1-metrics",
+                Detail: ({
+                  team_id: $team_id,
+                  repo: $repo,
+                  timestamp: (now | todate),
+                  prism_level: 3,
+                  metric: { name: "security_finding", value: 1, unit: "count" },
+                  ai_context: { tool: "gitleaks", model: "gitleaks-8.28.0" },
+                  security_agent_finding: {
+                    finding_id: ("gl-" + ($f.Fingerprint // "unknown")),
+                    phase: "code_review",
+                    severity: (if ($low_confidence | index($f.RuleID)) then "MEDIUM" else "HIGH" end),
+                    category: ($f.RuleID // "unknown"),
+                    title: ($f.Description // $f.RuleID // "Committed secret detected"),
+                    cwe_id: "CWE-798",
+                    cvss_score: null,
+                    exploit_validated: false,
+                    commit_shas: $commit_shas,
+                    pr_number: $pr_number,
+                    found_at: (now | todate)
+                  }
+                } | tostring)
+              } ]' "${REPORT}" 2>/dev/null || echo '[]')
+
+          TOTAL=$(echo "${ENTRIES}" | jq 'length')
+          if [ "${TOTAL}" -gt 0 ]; then
+            # EventBridge accepts max 10 entries per call
+            for i in $(seq 0 10 $((TOTAL - 1))); do
+              aws events put-events --region "$PRISM_AWS_REGION" \
+                --entries "$(echo "${ENTRIES}" | jq -c ".[$i:$((i+10))]")" || true
+            done
+            echo "Emitted ${TOTAL} gitleaks finding events to EventBridge"
+          fi
+
       - name: AWS Continuum security scan (Tier 2 -- deterministic)
         id: security-gate
         if: steps.aws-creds.outcome == 'success'
@@ -491,7 +787,7 @@ jobs:
           fi
 
       - name: Fail on eval gate failure
-        if: ${{ steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
+        if: ${{ steps.gitleaks-install.outputs.error == 'true' || steps.gitleaks.outputs.error == 'true' || (steps.gitleaks.outputs.leaks != '0' && steps.gitleaks.outputs.leaks != '') || steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
         env:
           REVIEW_RESULT: ${{ steps.review.outputs.result }}
           REVIEW_HIGH: ${{ steps.review.outputs.high }}
@@ -500,7 +796,21 @@ jobs:
           SEC_CRITICAL: ${{ steps.security-gate.outputs.critical }}
           SEC_HIGH: ${{ steps.security-gate.outputs.high }}
           SEC_SCAN_ERROR: ${{ steps.security-gate.outputs.scan_error }}
+          GITLEAKS_LEAKS: ${{ steps.gitleaks.outputs.leaks }}
+          GITLEAKS_ERROR: ${{ steps.gitleaks.outputs.error }}
+          GITLEAKS_INSTALL_ERROR: ${{ steps.gitleaks-install.outputs.error }}
         run: |
+          if [ "${GITLEAKS_INSTALL_ERROR}" = "true" ]; then
+            echo "❌ Secret scan failed closed: gitleaks could not be installed or verified."
+            echo "  This PR has NOT been scanned for credentials. Re-run the workflow."
+          elif [ "${GITLEAKS_ERROR}" = "true" ]; then
+            echo "❌ Secret scan failed closed: gitleaks produced no verdict."
+            echo "  This PR has NOT been scanned for credentials. Re-run the workflow."
+          elif [ -n "${GITLEAKS_LEAKS}" ] && [ "${GITLEAKS_LEAKS}" != "0" ]; then
+            echo "❌ gitleaks found ${GITLEAKS_LEAKS} secret(s) in this PR's commits"
+            echo "  Rotate the credential first -- deleting it from the branch does not un-expose it."
+            echo "  False positive? Add an allowlist entry to .gitleaks.toml."
+          fi
           if [ "${REVIEW_RESULT}" = "ERROR" ]; then
             echo "❌ Eval gate failed closed: review output could not be parsed"
           elif [ "${REVIEW_RESULT}" = "FAIL" ]; then