GitGuardian secret scan on package publish (blocking)

.github/workflows/release-production-core.yml

@@ -30,6 +30,9 @@ jobs:
       - name: Build all packages
         run: pnpm -r --sort run build
 
+      - name: Install ggshield
+        run: pipx install ggshield
+
       - name: Reading Configuration
         id: release_config
         uses: rgarcia-phi/json-to-variables@v1.1.0
@@ -40,6 +43,8 @@ jobs:
       - name: Publishing core (Production)
         id: publish-core
         uses: JS-DevTools/npm-publish@v3
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack/package.json
@@ -58,4 +63,4 @@ jobs:
             gh release create "$TAG" \
               --title "Core Production $VERSION" \
               --generate-notes
-          fi
+          fi

.github/workflows/release-production-platform-plugins.yml

@@ -30,6 +30,9 @@ jobs:
       - name: Build all plugins
         run: pnpm -r --sort run build
 
+      - name: Install ggshield
+        run: pipx install ggshield
+
       - name: Reading Configuration
         id: release_config
         uses: rgarcia-phi/json-to-variables@v1.1.0
@@ -40,6 +43,8 @@ jobs:
       # Utilities
       - name: Publishing utilities (Production)
         uses: JS-DevTools/npm-publish@v3
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-utilities/package.json
@@ -48,6 +53,8 @@ jobs:
       # Command
       - name: Publishing command (Production)
         uses: JS-DevTools/npm-publish@v3
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-command/package.json
@@ -56,6 +63,8 @@ jobs:
       # Config
       - name: Publishing config (Production)
         uses: JS-DevTools/npm-publish@v3
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-config/package.json
@@ -64,7 +73,9 @@ jobs:
       # Auth
       - name: Publishing auth (Production)
         uses: JS-DevTools/npm-publish@v3
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         with:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-auth/package.json
-          tag: latest
+          tag: latest

.gitignore

@@ -26,4 +26,5 @@ snyk_output.log
 **/migration-logs
 **/migration-logs/**
 *.logs
-tsconfig.tsbuildinfo
+tsconfig.tsbuildinfo
+.cache_ggshield

packages/contentstack-auth/package.json

@@ -8,7 +8,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "test": "mocha \"test/unit/**/*.test.ts\"",

packages/contentstack-command/package.json

@@ -8,6 +8,7 @@
   "scripts": {
     "build": "pnpm compile",
     "prepack": "pnpm compile",
+    "postpack": "ggshield secret scan archive ./*.tgz",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo",
     "compile": "tsc -b tsconfig.json",
     "test": "mocha \"test/unit/**/*.test.ts\"",
@@ -67,4 +68,4 @@
     "url": "git+https://github.com/contentstack/cli.git",
     "directory": "packages/contentstack-command"
   }
-}
+}

packages/contentstack-config/package.json

@@ -7,7 +7,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "test": "mocha \"test/unit/**/*.test.ts\"",

packages/contentstack-utilities/package.json

@@ -6,6 +6,7 @@
   "types": "lib/index.d.ts",
   "scripts": {
     "prepack": "pnpm compile",
+    "postpack": "ggshield secret scan archive ./*.tgz",
     "build": "pnpm compile",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo",
     "compile": "tsc -b tsconfig.json",
@@ -85,4 +86,4 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.9.3"
   }
-}
+}

packages/contentstack/package.json

@@ -12,7 +12,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "version": "oclif readme  && git add README.md",
     "test": "mocha \"test/unit/**/*.test.ts\"",
     "lint": "eslint src/**/*.ts",

pnpm-workspace.yaml

@@ -7,4 +7,5 @@ overrides:
   brace-expansion: 5.0.12
   js-yaml: 5.4.3
   fast-uri: 4.2.1
-  qs: 6.16.0
+  qs: 6.16.1
+  traverse: 0.6.14