Repository navigation
feat(builtins): add kingfisher secret scanner - #1160
Conversation
|
No actionable comments were generated in the recent review. π βΉοΈ Recent review infoβοΈ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: β Files ignored due to path filters (1)
π Files selected for processing (1)
π WalkthroughWalkthroughThe PR adds an executable ChangesKingfisher tool stub
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
π₯ Pre-merge checks | β 5β Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryAdds a Kingfisher secret-scanning builtin, including pass/fail fixtures and a pinned executable stub. The generated Pkl catalogue was not updated, so the new builtin is not yet exposed through
Confidence Score: 4/5The PR should not merge until the tracked Pkl builtin catalogue is regenerated so The scanner definition and test stub are internally consistent, but adding the source file alone leaves the generated public Pkl export stale and causes both user configuration resolution and the generated-file CI check to fail. Files Needing Attention: pkl/builtins/kingfisher.pkl and pkl/Builtins.pkl Important Files Changed
Reviews (1): Last reviewed commit: "feat(builtins): add kingfisher secret sc..." | Re-trigger Greptile |
β¦tomation (#31) * chore: manage dev tooling with mise and git hooks with hk Pin the Rust toolchain (with rustfmt/clippy), hk, pkl, shellcheck, cargo-audit, and cargo-tarpaulin via mise so contributors get the same tools CI uses. hk.pkl wires up pre-commit (fmt/clippy/shellcheck), pre-push (test suite), and commit-msg (conventional commit) hooks; mise's postinstall hook runs `hk install` automatically. * chore: sync Cargo.lock version with Cargo.toml (0.4.6) * chore: remove Copilot review workflow * chore: add PR Agent workflow for automated PR review Adapted from pantheon-org/tekhne's pr-agent.yml. Posts an LLM-generated description and review (Gemini primary, Mistral/Cerebras fallback), advisory only via continue-on-error. Skips cleanly if no provider API key secret is configured. Document the required secrets in CONTRIBUTING.md. * fix: bump trivy-action past the compromised release range (CVE-2026-33634) aquasecurity/trivy-action tags before 0.35.0 were force-pushed to malicious commits during the March 2026 Trivy supply-chain compromise (GHSA-69fq-xp46-6x23). Pin to the safe v0.35.0 commit by SHA instead of the mutable 0.20.0 tag. Verified action.yaml still exposes the scan-type/ scan-ref/format/output inputs this workflow uses. * chore: add Plumber CI/CD security scanning workflow Adapted from pantheon-org/tekhne's plumber.yml and its helper scripts (scripts/plumber-gate.sh, plumber-file-issues.sh, plumber-pr-comment.sh), which are repo-agnostic as-is. Critical findings block the PR; High/Medium/ Low are tracked via a per-PR comment and a rolling backlog issue, never blocking. .plumber.yaml is a minimal overlay (extends: plumber:default) generated with `plumber config generate --overlay`, rather than tekhne's full config which carries GitLab- and org-specific controls that don't apply here. The pre-existing Critical finding (trivy-action CVE) this scan surfaced was fixed in the prior commit so this lands with a clean gate; 14 pre-existing High findings (mostly actions pinned by tag instead of SHA) remain and will populate the backlog issue on the next push to main β tracked, not blocking, and out of scope for this change. * chore: add Kingfisher secret scanning (pre-commit hook + CI) Wire up MongoDB's Kingfisher (mongodb/kingfisher) as both a pre-commit hook (kingfisher scan . --staged, blocks on any secret in the staged diff) and a CI workflow (full working tree + git history, on push to main, on PRs, and weekly). Unlike Plumber's High/Medium/Low backlog model, any finding here fails the check outright. Installed via mise (github:mongodb/kingfisher) and, in CI, via jdx/mise-action pinned by SHA rather than Kingfisher's own curl-pipe install script, so this doesn't hand Plumber's mutable-remote-code control a new finding. .kingfisher-baseline.yml suppresses 7 pre-existing non-issues a full-history scan surfaced (a doc example and test-fixture strings in a briefly-committed target/ build artifact) so the gate starts clean rather than red on day one. Also fixes mise.toml's postinstall hook to run `hk install --mise` instead of plain `hk install` β without it the installed git hook couldn't resolve mise-installed tools like kingfisher on PATH at all. * fix: skip live credential validation in the kingfisher pre-commit hook hk merged an official Builtins.kingfisher upstream (jdx/hk#1160), still unreleased as of hk v1.54.1, so Builtins.kingfisher isn't available yet here. Its design does reveal one worthwhile change to adopt now though: --no-validate. Live validation makes real network calls against provider APIs (AWS, GitHub, Slack, etc.) for anything credential-shaped in the staged diff, which has no place adding latency and a network dependency to every commit. CI's full scan keeps validation on, since it isn't latency-sensitive and validation is what cuts down false positives there. * chore: add Renovate for automated dependency updates Configure Renovate (renovate.json5, extends config:recommended) to cover Cargo, GitHub Actions (including SHA-pin digest bumps), and mise (mise.toml/mise.lock β rust, hk, pkl, shellcheck, cargo-audit, cargo-tarpaulin, kingfisher). Verified extraction locally via `renovate --dry-run=extract` rather than assuming manager coverage from docs alone. Non-major updates (minor/patch/pin/digest) group into a single weekly PR across every ecosystem; major updates each get an independent PR. Schedule restricted to Monday 00:00-03:59 UTC using Renovate's recommended cron syntax. The Renovate GitHub App still needs to be installed on the repo for this to take effect β documented in CONTRIBUTING.md as a manual step. * fix: restore plumber script permissions and correct kingfisher mise install scripts/plumber-*.sh had lost their executable bit somewhere between the original `chmod +x` and the commit landing (git tracked them as 100644), causing `scripts/plumber-gate.sh: Permission denied` (exit 126) on every Plumber CI run. Restored via `git update-index --chmod`. kingfisher.yml's `install_args: kingfisher` passed a bare short name to `mise install`, which resolves against mise's central tool registry (no entry for kingfisher there) instead of matching the "github:mongodb/kingfisher" key in mise.toml. Reproduced locally with `mise install kingfisher` (fails, exact same error as CI) vs `mise install "github:mongodb/kingfisher"` (succeeds) before fixing. * fix: add multi-platform lockfile entries for kingfisher mise.lock only had version/backend for github:mongodb/kingfisher, no per-platform checksum/URL data on any platform (unlike aqua-backed tools such as hk/pkl/shellcheck, which mise populates for every platform automatically). jdx/mise-action runs `mise install --locked` by default, which requires a lockfile URL for the runner's exact platform, so the CI job failed with "No lockfile URL found for github:mongodb/kingfisher@1.110.0 on platform linux-x64 (--locked mode)". Fixed with `mise lock github:mongodb/kingfisher --platform linux-x64,linux-arm64,macos-arm64,macos-x64`, verified locally with `mise install --locked github:mongodb/kingfisher` (exit 0) before pushing.
This MR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [hk](https://github.com/jdx/hk) | tools | minor | `1.54.1` β `1.55.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>jdx/hk (hk)</summary> ### [`v1.55.0`](https://github.com/jdx/hk/blob/HEAD/CHANGELOG.md#1550---2026-08-11) [Compare Source](jdx/hk@v1.54.1...v1.55.0) ##### π Features - **(agent)** generate coding-agent integrations by [@​jdx](https://github.com/jdx) in [#​1171](jdx/hk#1171) - **(builtins)** add kingfisher secret scanner by [@​thoroc](https://github.com/thoroc) in [#​1160](jdx/hk#1160) - **(builtins)** classify command effects by [@​jdx](https://github.com/jdx) in [#​1167](jdx/hk#1167) - **(check)** add normalized diagnostics and SARIF by [@​jdx](https://github.com/jdx) in [#​1168](jdx/hk#1168) - **(mcp)** expose hk to coding agents by [@​jdx](https://github.com/jdx) in [#​1169](jdx/hk#1169) - **(mcp)** add interactive hk dashboard by [@​jdx](https://github.com/jdx) in [#​1170](jdx/hk#1170) - **(run)** add agent-friendly execution scoping by [@​jdx](https://github.com/jdx) in [#​1162](jdx/hk#1162) - **(run)** add structured execution results by [@​jdx](https://github.com/jdx) in [#​1163](jdx/hk#1163) - **(step)** add command effect safety by [@​jdx](https://github.com/jdx) in [#​1166](jdx/hk#1166) ##### π Bug Fixes - **(check)** exclude deleted paths from ref checks by [@​jdx](https://github.com/jdx) in [#​1177](jdx/hk#1177) - **(docs)** keep search modal above site navigation by [@​jdx](https://github.com/jdx) in [#​1188](jdx/hk#1188) - **(step)** support argv prefixes for structured commands by [@​jdx](https://github.com/jdx) in [#​1175](jdx/hk#1175) ##### π§ͺ Testing - **(init)** decouple agent docs assertion from releases by [@​jdx](https://github.com/jdx) in [#​1187](jdx/hk#1187) ##### π¦οΈ Dependency Updates - lock file maintenance by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1151](jdx/hk#1151) - simplify cargo version requirements by [@​jdx](https://github.com/jdx) in [#​1161](jdx/hk#1161) - lock file maintenance by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1173](jdx/hk#1173) - update zizmorcore/zizmor-action action to v0.6.2 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1180](jdx/hk#1180) - update jdx/mise-action action to v4.2.4 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1179](jdx/hk#1179) - update anthropics/claude-code-action action to v1.0.184 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1178](jdx/hk#1178) - update dependency [@​testing-library/jest-dom](https://github.com/testing-library/jest-dom) to v7 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1182](jdx/hk#1182) - update dependency jsdom to v30 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1183](jdx/hk#1183) - update dependency typescript to v7 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1184](jdx/hk#1184) - update jdx/mise-action action to v4.2.4 by [@​renovate\[bot\]](https://github.com/renovate\[bot]) in [#​1181](jdx/hk#1181) ##### New Contributors - [@​thoroc](https://github.com/thoroc) made their first contribution in [#​1160](jdx/hk#1160) </details> --- ### Configuration π **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. π **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
Just noticed that kingfisher wasn't included in the builtins - this PR addresses that.
Summary by CodeRabbit
mise.