{"id":22321509,"url":"https://github.com/jwndlng/github-secrets-observer","last_synced_at":"2025-03-26T04:42:00.214Z","repository":{"id":240979910,"uuid":"799623185","full_name":"jwndlng/github-secrets-observer","owner":"jwndlng","description":"Observe and alert on GitHub Secrets to facilitate regular rotation and enhance security and compliance.","archived":false,"fork":false,"pushed_at":"2024-06-11T07:10:47.000Z","size":33,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-31T06:35:28.508Z","etag":null,"topics":["compliance","secret-management","secret-rotation","security"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jwndlng.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-12T17:28:58.000Z","updated_at":"2024-06-11T07:09:23.000Z","dependencies_parsed_at":"2024-06-11T08:28:28.939Z","dependency_job_id":null,"html_url":"https://github.com/jwndlng/github-secrets-observer","commit_stats":null,"previous_names":["jwndlng/github-secrets-observer"],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwndlng%2Fgithub-secrets-observer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwndlng%2Fgithub-secrets-observer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwndlng%2Fgithub-secrets-observer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwndlng%2Fgithub-secrets-observer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jwndlng","download_url":"https://codeload.github.com/jwndlng/github-secrets-observer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245591617,"owners_count":20640692,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compliance","secret-management","secret-rotation","security"],"created_at":"2024-12-04T00:18:16.256Z","updated_at":"2025-03-26T04:42:00.195Z","avatar_url":"https://github.com/jwndlng.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# GitHub Secrets Observer\n\n## Overview\nGitHub Secrets Observer is an application designed to enhance security practices around the use of GitHub Secrets by monitoring the rotation of secrets across GitHub repositories.\n\n## Motivation\nMany organizations rely on GitHub for code management and use GitHub Secrets for secret management within GitHub Workflows. However, these secrets often are not rotated regularly, posing a security risk. This tool aims to automate secret rotation notifications, ensuring better compliance with security best practices.\n\n## Getting started\n\n### Download the latest release\n\nBrowse the [releases](https://github.com/jwndlng/github-secrets-observer/releases) and download the latest version. Follow the configuration guidances in the next section and run it!\n\n```bash\nUsage: github-secrets-observer [OPTIONS]\n\nOptions:\n  -o, --organization \u003cORGANIZATION\u003e    \n  -l, --log-level \u003cLOG_LEVEL\u003e          [default: INFO]\n  -n, --notifier-type \u003cNOTIFIER_TYPE\u003e  [possible values: slack, github, log]\n  -h, --help                           Print help\n```\n\n### Example Output\n\n```bash\n2024-06-....  INFO github_secrets_observer: Loading settings.\n2024-06-....  INFO github_secrets_observer: Observer initialized successfully.\n2024-06-....  INFO github_secrets_observer::notifier: 🤷 [state=Ignored, name=SECRET1, repository=my_org/my_repo, days_age=101, days_left=0, days_overdue=0] Secret is ignored.\n2024-06-.... ERROR github_secrets_observer::notifier: ❌ [state=Expired, name=SECRET2, repository=my_org/my_repo, days_age=170, days_left=0, days_overdue=80] Secret is expired.\n2024-06-....  INFO github_secrets_observer: Observer finished successfully.\n```\n\n### Configuration\n\nThe following table lists all of the options to configure the application\n\n| Name                         | Section   | Required | Default    | Note                                                                                         |\n| ---------------------------- | --------- | -------- | ---------- | -------------------------------------------------------------------------------------------- |\n| organization                 | github    | Yes      | -          | The GitHub organization that will be audited.                                                |\n| token                        | github    | Yes      | -          | The GitHub access token. Don't use the configuration file and use environments instead.      |\n| default_rotation_days        | observer  | No       | 90         | Default rotation in days for tokens that don't use the suffix. E.g. use `_R10` for 10 days.  |\n| expiration_notice_days       | observer  | No       | 14         | Default notice days, when a secret is considered to expire soon.                             |         \n| ignore_pattern               | observer  | No       | -          | Regex pattern that allows to ignore secrets from the scan that match the regex.              |\n| ignore_secrets               | observer  | No       | -          | List of secrets that will be ignored.                                                        |\n| notifier_type                | notifier  | No       | log        | Method that is used to notify about secrets.                                                 |\n| slack_webhook                | notifier  | No       | -          | Use Slack Webhook for notifications. Enable by setting an URL.                               |\n\nEach option can be either configured via the `config.toml` file or environment variables. Both can be used for different options.\n\nℹ️ **Info:** CLI arguments will override the settings.\n\n#### Using the configuration file\nThe configuration file uses the TOML format. The current configuration does not use a nested pattern. So each section contains the options listed above. \n\n#### Using environment variables\nThe environment variables must use the prefix `GHSO` and follow the pattern `Prefix_Section_Name`. For the organization the environment variable would be `GHSO_GITHUB_ORGANIZATION`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjwndlng%2Fgithub-secrets-observer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjwndlng%2Fgithub-secrets-observer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjwndlng%2Fgithub-secrets-observer/lists"}