Add gh actions to replace travis by carloscumpian · Pull Request #60 · IBM/detect-secrets-stream

carloscumpian · 2026-03-31T17:00:34Z

Using Standard GitHub-hosted runners
Deploy section needs to be uncommented out
Secrets need to be added for deploy section

Updated versions for setuptools to 82.0.1 and pip to 26.0 in dockerfile.dss to fix high vulns:

Updated versions for cryptography in Pipfile to fix and added dependencies:

CVE-2026-26007
ibm-cloud-sdk-core = "==3.24.4" (added) - was previously already part of pipfile
ibm-secrets-manager-sdk = "2.1.19" (added) - was previously already part of pipfile
ibm-db = "==3.2.8" (upgraded version)
cryptography = ">=46.0.5" (upgraded version)

Formatted vault.py based on pre-commit check feedback

Mostly removing spaces + unused imports within vault.py

Updated vault_test.py so that the test would work w/ GHA
Small fixes for Makefile(added -f for a plugin + pipenv to pre-commit run

Signed-off-by: Stephen Linnell <sclinnell@ibm.com>

Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com>

* Update cronjob.yaml Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding case for empty secret Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * return a request response instead of string Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * Patching detect-secrets-stream image (#22) * Fix Makefile deploy: no need for looping (#225) * Fix Makefile deploy: no need for looping Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Remove unnecessary ; Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Store image name in var Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Clean up Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * More clean up Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Refactor Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> --------- Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating detect-secrets version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating more dependencies for pipfile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating requests Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating cryptography to higher version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pre-commit version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pipenv version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding an ignore virtualenvs flag to verify how builds runs with specified versions Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating makefile to create its own virtualenv Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding more override virtual env flags to makefile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * addng more pip ignore installed flags Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating python version for travis build Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * reverting makefile and testing travisyml Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * removing travis update Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding newline back to end of makefile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating python base image version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * bumping travis and dockerfile to latest 3.9 release Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating python version in dockerfile to 3.9.19 Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pipenv to latest version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * reverting dockerfile change and updating python version to lock Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pipfile.lock for python update Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * locking pip version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * locking pip version and updating pipfile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * udpating pipfile and dockerfile to fix vulns Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * Updating gevent to 23.9.1 to fix travis build Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pyjwt version to fix travis build Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * checking trivy version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding skip-dirs flag to remove trivy false positive Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * checking previous pipenv version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> --------- Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> Co-authored-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * Patching detect-secrets-stream image (#22) * Fix Makefile deploy: no need for looping (#225) * Fix Makefile deploy: no need for looping Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Remove unnecessary ; Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Store image name in var Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Clean up Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * More clean up Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> * Refactor Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> --------- Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating detect-secrets version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating more dependencies for pipfile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating requests Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating cryptography to higher version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pre-commit version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pipenv version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding an ignore virtualenvs flag to verify how builds runs with specified versions Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating makefile to create its own virtualenv Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding more override virtual env flags to makefile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * addng more pip ignore installed flags Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating python version for travis build Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * reverting makefile and testing travisyml Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * removing travis update Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding newline back to end of makefile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating python base image version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * bumping travis and dockerfile to latest 3.9 release Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating python version in dockerfile to 3.9.19 Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pipenv to latest version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * reverting dockerfile change and updating python version to lock Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pipfile.lock for python update Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * locking pip version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * locking pip version and updating pipfile Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * udpating pipfile and dockerfile to fix vulns Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * Updating gevent to 23.9.1 to fix travis build Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating pyjwt version to fix travis build Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * checking trivy version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * adding skip-dirs flag to remove trivy false positive Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> * checking previous pipenv version Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> --------- Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> Co-authored-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> --------- Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com> Signed-off-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com> Co-authored-by: Stephen Linnell <91089808+sclinnell@users.noreply.github.com> Co-authored-by: Stephen Linnell <sclinnell@ibm.com> Co-authored-by: Victoria Miltcheva <12804086+victoria-miltcheva@users.noreply.github.com>

Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com>

* adding patching efforts Signed-off-by: Kristi-Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating cryptography Signed-off-by: Kristi-Kazmierczak <Kristi.Kazmierczak@ibm.com> --------- Signed-off-by: Kristi-Kazmierczak <Kristi.Kazmierczak@ibm.com>

This reverts commit e9de35b, reversing changes made to 296689c.

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

sclinnell

:pacha:

Looks great! When do you plan to add the secrets and uncomment the deploy section?

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

The base branch was changed.

sclinnell and others added 24 commits September 12, 2023 14:41

code updates for vault.py

aac90f5

more changes for return objects

bb1d087

Signed-off-by: Stephen Linnell <sclinnell@ibm.com>

some final changes to clean up the code

dd468a2

Signed-off-by: Stephen Linnell <sclinnell@ibm.com>

update pipfile stuff

b6f5570

Signed-off-by: Stephen Linnell <sclinnell@ibm.com>

new updates

25e88e6

Signed-off-by: Stephen Linnell <sclinnell@ibm.com>

updates from suggestions

5661150

Signed-off-by: Stephen Linnell <sclinnell@ibm.com>

updating how the config file is pulled in

8ffdc3b

Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com>

change to read secret by name

d336418

update tests

ff63555

add mock vals

3dc3b4f

updating some things

f14ce82

addition for updating secret

84dcc9c

final updates for dss

abadda5

Update cronjob.yaml

b2df7e5

Update cronjob.yaml

0534067

Update cronjob.yaml

d4b2056

adding case for empty secret

ca59c52

return a request response instead of string

d5364de

pulling in patching from main (#29)

500b534

Signed-off-by: Kristi Kazmierczak <Kristi.Kazmierczak@ibm.com>

Patching (#35)

296689c

* adding patching efforts Signed-off-by: Kristi-Kazmierczak <Kristi.Kazmierczak@ibm.com> * updating cryptography Signed-off-by: Kristi-Kazmierczak <Kristi.Kazmierczak@ibm.com> --------- Signed-off-by: Kristi-Kazmierczak <Kristi.Kazmierczak@ibm.com>

Added changes from main to ibm-cloud-secrets-manager

e9de35b

Revert "Added changes from main to ibm-cloud-secrets-manager"

074b74f

This reverts commit e9de35b, reversing changes made to 296689c.

Re-apply updates from main (revert the revert)

663c7a1

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian force-pushed the add-gh-actions branch from 17e89b4 to 8dbcfa5 Compare March 31, 2026 17:12

carloscumpian added 5 commits March 31, 2026 16:55

Initial GHA test

1deb9f3

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update runner and add cache

91a1bb7

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update runner to use GHs

82b4d7f

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Add setuptools installations

3964aa0

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix for pkg_resources error

8c168f0

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian added 18 commits March 31, 2026 16:55

Add ibm-cloud-sdk-core to Pipfile for tests to function

593130a

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update pip for tests

8c0d6fc

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Add GD_VAULT_CONF env to fix tests errors

75035b9

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix vault_test.py by using GD_VAULT_CONF env

6eac933

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix mock data for vault_test.py

04e0df9

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update mock tests for vault_test.py

60aa8d2

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update mock tests for vault_test.py p.2

643735d

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix cryptography vuln in pipfile

3ab31a3

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Add pipenv to pre-commit due to GHA diff

e76db3a

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix format based on pre=commit checks

8ea07b3

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix python-pkg vulns

a077040

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Revert pipfile changes + update packages in dockerfile

38da1d4

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix wheel and jaraco.context vulns

99e73ec

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Fix wheel and jaraco.context vulns in Dockerfile Stage 3

c885703

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update how packages are updated in docker

b9bde5f

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update setuptools version in Dockerfile

51ccbde

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update to exact version + remove --upgrade from Dockerfile

b33cd2c

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Add -f flag to makefile for plugin

b9f7d9b

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian force-pushed the add-gh-actions branch from cca512c to b9f7d9b Compare March 31, 2026 21:55

carloscumpian requested review from krkazmier and sclinnell March 31, 2026 21:56

carloscumpian added 3 commits March 31, 2026 17:31

Upgraded pyjwt + set exact versions for ibm-secrets + cloud

e9dbb87

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Remove blank space in Pipfile

b4572ab

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update pipfile.lock

53d05d3

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

sclinnell previously approved these changes Apr 1, 2026

View reviewed changes

carloscumpian added 2 commits April 2, 2026 12:25

Pin 3.12.13 version + uncomment deploy section

6471719

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

Update how GHA handles cache/version changes

a4fb3b1

Signed-off-by: Caleb Cumpian <Carlos.Cumpian@ibm.com>

carloscumpian changed the base branch from updates-from-main to main April 2, 2026 17:34

sclinnell approved these changes Apr 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add gh actions to replace travis#60

Add gh actions to replace travis#60
carloscumpian wants to merge 56 commits intomainfrom
add-gh-actions

carloscumpian commented Mar 31, 2026 •

edited

Loading

Uh oh!

sclinnell left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

carloscumpian commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sclinnell left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

carloscumpian commented Mar 31, 2026 •

edited

Loading

sclinnell left a comment •

edited

Loading