From 45f3b0be2b65d2b381268d22c714d2fe27e8c3e5 Mon Sep 17 00:00:00 2001
From: alok-cstk <alok.shukla@contentstack.com>
Date: Wed, 21 Oct 2026 14:08:40 +0530
Subject: [PATCH] Add GitGuardian secret scan on publish (postpack hook,
 blocking); install ggshield in release workflow; ignore ggshield cache
 (IS-7341)

---
 .github/workflows/release.yml | 7 +++++++
 .gitignore                    | 4 +++-
 package.json                  | 1 +
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b601e47..ccef0e1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,8 +18,12 @@ jobs:
       - run: npm ci
       - name: Update npm
         run: npm install -g npm@latest
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Release
         run: npm publish --access public
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
   publish-github:
     runs-on: ubuntu-latest
     permissions:
@@ -35,7 +39,10 @@ jobs:
       - run: npm ci
       - name: Update npm
         run: npm install -g npm@latest
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Release
         run: npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ github.token }}
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index a4be93a..34b06cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,6 @@
 /coverage
 
 .env
-.DS_Store
\ No newline at end of file
+.DS_Store
+# Added by ggshield
+.cache_ggshield
diff --git a/package.json b/package.json
index a35c2be..d707cad 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,7 @@
   "scripts": {
     "prepare": "npm run build",
     "build": "tsup",
+    "postpack": "ggshield secret scan archive ./*.tgz",
     "husky-check": "npx husky && chmod +x .husky/pre-commit",
     "test": "cross-env NODE_OPTIONS=--experimental-vm-modules jest --testPathPattern=tests",
     "test:unit:report:json": "cross-env NODE_OPTIONS=--experimental-vm-modules jest --testPathPattern=tests/unit --coverage --coverageReporters=clover --coverageReporters=json --coverageDirectory=coverage --testResultsProcessor=jest-json-reporter --outputFile=test-results.json"