Jaypore CI

> Jaypore CI: Minimal, Offline, Local CI system.
Log | Files | Refs | README | LICENSE

README.md (1920B)

      1 # TruffleHog Secret Scan
      2 
      3 Automatically scan your repository for leaked secrets every hour using
      4 [trufflehog3](https://github.com/feeltheajf/trufflehog3).
      5 
      6 ## What is TruffleHog?
      7 
      8 TruffleHog scans a Git repository for accidentally committed secrets—API keys,
      9 tokens, passwords, private keys, and other high-entropy strings that should
     10 never appear in source control. It checks both the current working tree and the
     11 full commit history, so even secrets that were "deleted" in a later commit are
     12 caught.
     13 
     14 ## How the hourly scan works
     15 
     16 The file `.jci/crontab` contains:
     17 
     18 ```
     19 0 * * * * run
     20 ```
     21 
     22 This tells Jaypore CI to execute `.jci/run.sh` once every hour (at minute 0).
     23 
     24 To install (or update) this schedule into the system crontab, run:
     25 
     26 ```bash
     27 git jci cron sync
     28 ```
     29 
     30 `cron sync` reads `.jci/crontab`, translates each line into a real crontab
     31 entry that invokes `git jci run` inside the repository, and writes it to the
     32 current user's crontab. Run the command again after changing `.jci/crontab` to
     33 pick up new schedules.
     34 
     35 ## What the scan does
     36 
     37 1. `cd` into the repo root.
     38 2. Run `trufflehog3` against the current working tree to find secrets in
     39    checked-out files.
     40 3. Run `trufflehog3` against the commit history to find secrets that were ever
     41    committed.
     42 4. Merge both results into `$JCI_OUTPUT_DIR/trufflehog-report.txt`.
     43 5. If any secrets are found, print the report and exit with code **1** so
     44    Jaypore CI records the run as failed.
     45 6. If the repo is clean, exit with code **0**.
     46 
     47 ## Customisation
     48 
     49 You can tweak the scan by editing `.jci/run.sh`:
     50 
     51 - **Severity filter** – add `--severity HIGH` to only flag high-confidence
     52   findings.
     53 - **Limit history depth** – add `--depth 100` to scan only the last 100
     54   commits.
     55 - **Custom rules** – pass `--rules /path/to/rules.yaml` to use your own
     56   patterns.
     57 - **JSON output** – change `--format TEXT` to `--format JSON` for
     58   machine-readable results.