GitGuardian secret scan on package publish (blocking)

.github/workflows/release.yml

@@ -20,10 +20,14 @@ jobs:
           registry-url: https://registry.npmjs.org/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish --access public --tag ${{ github.event.release.prerelease && 'beta' || 'latest' }}
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
   publish-github:
     runs-on: ubuntu-latest
@@ -41,9 +45,12 @@ jobs:
           registry-url: https://npm.pkg.github.com/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish
         env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
           NODE_AUTH_TOKEN: ${{ github.token }}

.gitignore

@@ -47,4 +47,5 @@ test/docs/*.mjs
 test/docs/sanity-report*
 *.log
 .nx/
-delivery-sdk-persistence/
+delivery-sdk-persistence/
+.cache_ggshield

.npmignore

@@ -19,4 +19,5 @@ src
 *.tgz
 .talismanrc
 tap-html.html 
-.github
+.github
+.cache_ggshield

package.json

@@ -23,7 +23,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "prepare": "npm run build",
+      "postpack": "ggshield secret scan archive ./*.tgz",
+  "prepare": "npm run build",
     "test": "jest ./test/unit",
     "test:unit": "jest ./test/unit",
     "test:api": "ENABLE_HTTP_CAPTURE=true jest ./test/api",