GitGuardian secret scan on package publish (blocking)

.github/workflows/release-production-plugins.yml

@@ -29,6 +29,8 @@ jobs:
       - name: Install root dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Build all plugins
         run: pnpm -r --sort run build
 
@@ -47,6 +49,8 @@ jobs:
           package: ./packages/contentstack-asset-management/package.json
           access: public
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Variants
       - name: Publishing variants (Production)
@@ -55,6 +59,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-variants/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Export
       - name: Publishing export (Production)
@@ -63,6 +69,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-export/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Audit
       - name: Publishing audit (Production)
@@ -71,6 +79,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-audit/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Import
       - name: Publishing import (Production)
@@ -79,6 +89,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-import/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Clone
       - name: Publishing clone (Production)
@@ -87,6 +99,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-clone/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Import Setup
       - name: Publishing import-setup (Production)
@@ -95,6 +109,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-import-setup/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Export to CSV
       - name: Publishing export-to-csv (Production)
@@ -103,6 +119,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-export-to-csv/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Migration
       - name: Publishing migration (Production)
@@ -111,6 +129,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-migration/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Migrate RTE
       - name: Publishing migrate-rte (Production)
@@ -120,6 +140,8 @@ jobs:
           package: ./packages/contentstack-migrate-rte/package.json
           access: public
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Seed
       - name: Publishing seed (Production)
@@ -128,6 +150,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-seed/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Bootstrap
       - name: Publishing bootstrap (Production)
@@ -136,6 +160,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-bootstrap/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Branches
       - name: Publishing branches (Production)
@@ -144,6 +170,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-branches/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Apps CLI
       - name: Publishing apps-cli (Production)
@@ -152,6 +180,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-apps-cli/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Query Export
       - name: Publishing query-export (Production)
@@ -160,6 +190,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-query-export/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Content Type
       - name: Publishing content-type (Production)
@@ -168,6 +200,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-content-type/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Regex Validate
       - name: Publishing regex-validate (Production)
@@ -177,6 +211,8 @@ jobs:
           package: ./packages/contentstack-cli-cm-regex-validate/package.json
           access: public
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Tsgen
       - name: Publishing tsgen (Production)
@@ -185,6 +221,8 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-cli-tsgen/package.json
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # External Migrate
       - name: Publishing external-migrate (Production)
@@ -194,6 +232,8 @@ jobs:
           package: ./packages/contentstack-external-migrate/package.json
           access: public
           tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
       # Bulk Operations
       - name: Publishing bulk-operations (Production)
@@ -202,4 +242,6 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-bulk-operations/package.json
           access: public
-          tag: latest
+          tag: latest
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

.gitignore

@@ -25,4 +25,5 @@ snyk_output.log
 .cursor/rules/snyk_rules.mdc
 **/migration-logs
 **/migration-logs/**
-*.logs
+*.logs
+.cache_ggshield

packages/contentstack-apps-cli/package.json

@@ -82,7 +82,7 @@
   "scripts": {
     "build": "pnpm compile",
     "lint": "eslint \"src/**/*.ts\"",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "test": "mocha --forbid-only \"test/unit/**/*.test.ts\"",
     "version": "oclif readme && git add README.md",

packages/contentstack-asset-management/package.json

@@ -12,7 +12,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "lint": "eslint \"src/**/*.ts\"",

packages/contentstack-audit/package.json

@@ -66,7 +66,7 @@
   "scripts": {
     "build": "pnpm compile && oclif manifest && oclif readme",
     "lint": "eslint \"src/**/*.ts\"",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "test": "mocha --timeout 10000 --forbid-only --file test/unit/logger-config.js \"test/unit/**/*.test.ts\"",

packages/contentstack-bootstrap/package.json

@@ -8,7 +8,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "pretest": "pnpm compile",

packages/contentstack-branches/package.json

@@ -30,7 +30,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "pretest": "tsc -p test",

packages/contentstack-bulk-operations/package.json

@@ -81,7 +81,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "lint": "eslint \"src/**/*.ts\"",
     "format": "eslint \"src/**/*.ts\" --fix",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme && pnpm changelog",
     "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",
     "test": "mocha --forbid-only \"test/unit/**/*.test.ts\"",

packages/contentstack-cli-cm-regex-validate/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "build": "pnpm compile && oclif manifest && oclif readme",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "pretest": "tsc -p test",
     "test": "mocha --forbid-only \"test/**/*.test.ts\"",

packages/contentstack-cli-tsgen/package.json

@@ -60,7 +60,7 @@
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
     "lint": "eslint \"src/**/*.ts\"",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "test": "jest --testPathPattern=test/unit",
     "test:integration": "jest --testPathPattern=test/integration",

packages/contentstack-clone/package.json

@@ -68,7 +68,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "pretest": "tsc -p test",
     "lint": "eslint \"src/**/*.ts\"",

packages/contentstack-content-type/package.json

@@ -68,7 +68,7 @@
   "scripts": {
     "build": "pnpm compile && oclif manifest && oclif readme",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "test": "jest",
     "lint": "eslint \"src/**/*.ts\"",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",

packages/contentstack-export-to-csv/package.json

@@ -70,7 +70,7 @@
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
     "lint": "eslint \"src/**/*.ts\"",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "test": "mocha --timeout 10000 --forbid-only \"test/unit/**/*.test.ts\"",
     "version": "oclif readme && git add README.md",

packages/contentstack-export/package.json

@@ -49,7 +49,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "pretest": "tsc -p test",

packages/contentstack-external-migrate/package.json

@@ -15,7 +15,7 @@
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json && node scripts/copy-assets.js",
     "lint": "eslint \"src/**/*.ts\"",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "pretest": "tsc -p test",
     "test": "mocha --forbid-only \"test/**/*.test.ts\"",

packages/contentstack-import-setup/package.json

@@ -44,7 +44,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "pretest": "tsc -p test",
     "lint": "eslint \"src/**/*.ts\"",

packages/contentstack-import/package.json

@@ -46,7 +46,7 @@
     "build": "pnpm compile && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "pretest": "tsc -p test",

packages/contentstack-migrate-rte/package.json

@@ -72,7 +72,7 @@
   },
   "scripts": {
     "build": "oclif manifest",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "oclif manifest && oclif readme",
     "test": "nyc --check-coverage=false mocha --require test/setup.js --forbid-only \"test/**/*.test.js\"",
     "version": "oclif readme && git add README.md",

packages/contentstack-migration/package.json

@@ -60,7 +60,7 @@
   },
   "scripts": {
     "build": "pnpm compile && oclif manifest && oclif readme",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "generate-api-ref-md-doc": "nyc jsdoc2md ./src/modules/*.ts > ./docs/api-reference.md || true",
     "compile": "tsc -b tsconfig.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",

packages/contentstack-query-export/package.json

@@ -52,7 +52,7 @@
     "build": "pnpm compile && pnpm copy-config && oclif manifest && oclif readme",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",
     "compile": "tsc -b tsconfig.json",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "copy-config": "cp -r src/config lib/",
     "prepack": "pnpm compile && pnpm copy-config && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",

packages/contentstack-seed/package.json

@@ -68,7 +68,7 @@
   },
   "scripts": {
     "test": "jest",
-    "postpack": "rm -f oclif.manifest.json",
+    "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json",
     "prepack": "pnpm compile && oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
     "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo oclif.manifest.json",

packages/contentstack-variants/package.json

@@ -5,7 +5,8 @@
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "scripts": {
-    "build": "pnpm compile",
+      "postpack": "ggshield secret scan archive ./*.tgz",
+  "build": "pnpm compile",
     "prepack": "pnpm compile",
     "compile": "tsc -b tsconfig.json",
     "test": "mocha --forbid-only \"test/unit/**/*.test.ts\"",