From 7ff5f196162bc4d7d6d835e8eeaf30e045a0262f Mon Sep 17 00:00:00 2001
From: alok-cstk <alok.shukla@contentstack.com>
Date: Fri, 30 Oct 2026 17:00:57 +0530
Subject: [PATCH] Add GitGuardian secret scan on publish (postpack hook,
 blocking); install ggshield in release workflow (IS-7341)

---
 .github/workflows/release.yml | 7 +++++++
 .gitignore                    | 3 ++-
 .npmignore                    | 3 ++-
 package.json                  | 3 ++-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 87c49000..1a003e8f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,10 +20,14 @@ jobs:
           registry-url: https://registry.npmjs.org/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish --access public --tag ${{ github.event.release.prerelease && 'beta' || 'latest' }}
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
   publish-github:
     runs-on: ubuntu-latest
@@ -41,9 +45,12 @@ jobs:
           registry-url: https://npm.pkg.github.com/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish
         env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
           NODE_AUTH_TOKEN: ${{ github.token }}
diff --git a/.gitignore b/.gitignore
index bccf9ea7..7a38e6ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,4 +47,5 @@ test/docs/*.mjs
 test/docs/sanity-report*
 *.log
 .nx/
-delivery-sdk-persistence/
\ No newline at end of file
+delivery-sdk-persistence/
+.cache_ggshield
diff --git a/.npmignore b/.npmignore
index 47e14fe6..75952bdf 100644
--- a/.npmignore
+++ b/.npmignore
@@ -19,4 +19,5 @@ src
 *.tgz
 .talismanrc
 tap-html.html 
-.github
\ No newline at end of file
+.github
+.cache_ggshield
diff --git a/package.json b/package.json
index d638cf7e..caede19a 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "prepare": "npm run build",
+      "postpack": "ggshield secret scan archive ./*.tgz",
+  "prepare": "npm run build",
     "test": "jest ./test/unit",
     "test:unit": "jest ./test/unit",
     "test:api": "ENABLE_HTTP_CAPTURE=true jest ./test/api",