Skip to content

feat(builtins): add kingfisher secret scanner - #1160

Merged
jdx merged 1 commit into
jdx:mainfrom
thoroc:main
Aug 9, 2026
Merged

jdx merged 1 commit into
jdx:mainfrom
thoroc:main

Conversation

@thoroc

@thoroc thoroc commented Aug 7, 2026 •

Copy link
Copy Markdown
Contributor

Just noticed that kingfisher wasn't included in the builtins - this PR addresses that.

Summary by CodeRabbit

  • New Features
    • Added support for installing MongoDB’s Kingfisher tool through mise.
    • Pinned Kingfisher to version 1.109.0 for consistent setup.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026 •

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. πŸŽ‰

ℹ️ Recent review info
βš™οΈ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d52f1572-7740-4c61-97da-1376cf548fa2

πŸ“₯ Commits

Reviewing files that changed from the base of the PR and between dc35871 and 78c4d97.

β›” Files ignored due to path filters (1)
  • pkl/builtins/kingfisher.pkl is excluded by !**/*.pkl
πŸ“’ Files selected for processing (1)
  • test/builtin_tool_stubs/kingfisher

πŸ“ Walkthrough

Walkthrough

The PR adds an executable mise tool stub for github:mongodb/kingfisher and pins it to version 1.109.0.

Changes

Kingfisher tool stub

Layer / File(s) Summary
Add pinned Kingfisher stub
test/builtin_tool_stubs/kingfisher
The test stub declares github:mongodb/kingfisher at version 1.109.0 and marks it executable.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A rabbit found a tool stub bright,
Pinned Kingfisher just right.
1.109.0 in place,
Ready for the test-run race.
Hop, hopβ€”clean and light!

πŸš₯ Pre-merge checks | βœ… 5
βœ… Passed checks (5 passed)
Check name Status Explanation
Description Check βœ… Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check βœ… Passed The title clearly and concisely describes adding Kingfisher as a built-in secret scanner.
Docstring Coverage βœ… Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check βœ… Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check βœ… Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❀️ Share

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Greptile Summary

Adds a Kingfisher secret-scanning builtin, including pass/fail fixtures and a pinned executable stub. The generated Pkl catalogue was not updated, so the new builtin is not yet exposed through Builtins.kingfisher.

  • Defines Kingfisher as a text-file check with update checks and live validation disabled.
  • Tests clean content and a synthetic Slack token with Kingfisher's findings exit code.
  • Adds a version 1.109.0 tool stub for builtin tests.

Confidence Score: 4/5

The PR should not merge until the tracked Pkl builtin catalogue is regenerated so Builtins.kingfisher is available and the render check remains clean.

The scanner definition and test stub are internally consistent, but adding the source file alone leaves the generated public Pkl export stale and causes both user configuration resolution and the generated-file CI check to fail.

Files Needing Attention: pkl/builtins/kingfisher.pkl and pkl/Builtins.pkl

Important Files Changed

Filename Overview
pkl/builtins/kingfisher.pkl Adds the scanner definition and embedded tests, but omits regeneration of the tracked public builtin catalogue.
test/builtin_tool_stubs/kingfisher Adds a convention-compatible executable stub pinned to Kingfisher 1.109.0.

Reviews (1): Last reviewed commit: "feat(builtins): add kingfisher secret sc..." | Re-trigger Greptile

Comment thread pkl/builtins/kingfisher.pkl Resolved
@jdx
jdx merged commit 042258a into jdx:main Aug 9, 2026
28 checks passed
@jdx jdx mentioned this pull request Aug 9, 2026
thoroc added a commit to thoroc/git-mirror that referenced this pull request Aug 11, 2026
…tomation (#31)

* chore: manage dev tooling with mise and git hooks with hk

Pin the Rust toolchain (with rustfmt/clippy), hk, pkl, shellcheck,
cargo-audit, and cargo-tarpaulin via mise so contributors get the same
tools CI uses. hk.pkl wires up pre-commit (fmt/clippy/shellcheck),
pre-push (test suite), and commit-msg (conventional commit) hooks;
mise's postinstall hook runs `hk install` automatically.

* chore: sync Cargo.lock version with Cargo.toml (0.4.6)

* chore: remove Copilot review workflow

* chore: add PR Agent workflow for automated PR review

Adapted from pantheon-org/tekhne's pr-agent.yml. Posts an LLM-generated
description and review (Gemini primary, Mistral/Cerebras fallback),
advisory only via continue-on-error. Skips cleanly if no provider
API key secret is configured. Document the required secrets in
CONTRIBUTING.md.

* fix: bump trivy-action past the compromised release range (CVE-2026-33634)

aquasecurity/trivy-action tags before 0.35.0 were force-pushed to malicious
commits during the March 2026 Trivy supply-chain compromise
(GHSA-69fq-xp46-6x23). Pin to the safe v0.35.0 commit by SHA instead of the
mutable 0.20.0 tag. Verified action.yaml still exposes the scan-type/
scan-ref/format/output inputs this workflow uses.

* chore: add Plumber CI/CD security scanning workflow

Adapted from pantheon-org/tekhne's plumber.yml and its helper scripts
(scripts/plumber-gate.sh, plumber-file-issues.sh, plumber-pr-comment.sh),
which are repo-agnostic as-is. Critical findings block the PR; High/Medium/
Low are tracked via a per-PR comment and a rolling backlog issue, never
blocking. .plumber.yaml is a minimal overlay (extends: plumber:default)
generated with `plumber config generate --overlay`, rather than tekhne's
full config which carries GitLab- and org-specific controls that don't
apply here.

The pre-existing Critical finding (trivy-action CVE) this scan surfaced
was fixed in the prior commit so this lands with a clean gate; 14
pre-existing High findings (mostly actions pinned by tag instead of SHA)
remain and will populate the backlog issue on the next push to main β€”
tracked, not blocking, and out of scope for this change.

* chore: add Kingfisher secret scanning (pre-commit hook + CI)

Wire up MongoDB's Kingfisher (mongodb/kingfisher) as both a pre-commit
hook (kingfisher scan . --staged, blocks on any secret in the staged
diff) and a CI workflow (full working tree + git history, on push to
main, on PRs, and weekly). Unlike Plumber's High/Medium/Low backlog
model, any finding here fails the check outright.

Installed via mise (github:mongodb/kingfisher) and, in CI, via
jdx/mise-action pinned by SHA rather than Kingfisher's own curl-pipe
install script, so this doesn't hand Plumber's mutable-remote-code
control a new finding.

.kingfisher-baseline.yml suppresses 7 pre-existing non-issues a
full-history scan surfaced (a doc example and test-fixture strings in
a briefly-committed target/ build artifact) so the gate starts clean
rather than red on day one.

Also fixes mise.toml's postinstall hook to run `hk install --mise`
instead of plain `hk install` β€” without it the installed git hook
couldn't resolve mise-installed tools like kingfisher on PATH at all.

* fix: skip live credential validation in the kingfisher pre-commit hook

hk merged an official Builtins.kingfisher upstream (jdx/hk#1160), still
unreleased as of hk v1.54.1, so Builtins.kingfisher isn't available yet
here. Its design does reveal one worthwhile change to adopt now though:
--no-validate. Live validation makes real network calls against
provider APIs (AWS, GitHub, Slack, etc.) for anything credential-shaped
in the staged diff, which has no place adding latency and a network
dependency to every commit. CI's full scan keeps validation on, since
it isn't latency-sensitive and validation is what cuts down false
positives there.

* chore: add Renovate for automated dependency updates

Configure Renovate (renovate.json5, extends config:recommended) to
cover Cargo, GitHub Actions (including SHA-pin digest bumps), and mise
(mise.toml/mise.lock β€” rust, hk, pkl, shellcheck, cargo-audit,
cargo-tarpaulin, kingfisher). Verified extraction locally via
`renovate --dry-run=extract` rather than assuming manager coverage
from docs alone.

Non-major updates (minor/patch/pin/digest) group into a single weekly
PR across every ecosystem; major updates each get an independent PR.
Schedule restricted to Monday 00:00-03:59 UTC using Renovate's
recommended cron syntax.

The Renovate GitHub App still needs to be installed on the repo for
this to take effect β€” documented in CONTRIBUTING.md as a manual step.

* fix: restore plumber script permissions and correct kingfisher mise install

scripts/plumber-*.sh had lost their executable bit somewhere between
the original `chmod +x` and the commit landing (git tracked them as
100644), causing `scripts/plumber-gate.sh: Permission denied` (exit
126) on every Plumber CI run. Restored via `git update-index --chmod`.

kingfisher.yml's `install_args: kingfisher` passed a bare short name to
`mise install`, which resolves against mise's central tool registry
(no entry for kingfisher there) instead of matching the
"github:mongodb/kingfisher" key in mise.toml. Reproduced locally with
`mise install kingfisher` (fails, exact same error as CI) vs
`mise install "github:mongodb/kingfisher"` (succeeds) before fixing.

* fix: add multi-platform lockfile entries for kingfisher

mise.lock only had version/backend for github:mongodb/kingfisher, no
per-platform checksum/URL data on any platform (unlike aqua-backed
tools such as hk/pkl/shellcheck, which mise populates for every
platform automatically). jdx/mise-action runs `mise install --locked`
by default, which requires a lockfile URL for the runner's exact
platform, so the CI job failed with "No lockfile URL found for
github:mongodb/kingfisher@1.110.0 on platform linux-x64 (--locked
mode)".

Fixed with `mise lock github:mongodb/kingfisher --platform
linux-x64,linux-arm64,macos-arm64,macos-x64`, verified locally with
`mise install --locked github:mongodb/kingfisher` (exit 0) before
pushing.
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Aug 12, 2026
This MR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [hk](https://github.com/jdx/hk) | tools | minor | `1.54.1` β†’ `1.55.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>jdx/hk (hk)</summary>

### [`v1.55.0`](https://github.com/jdx/hk/blob/HEAD/CHANGELOG.md#1550---2026-08-11)

[Compare Source](jdx/hk@v1.54.1...v1.55.0)

##### πŸš€ Features

- **(agent)** generate coding-agent integrations by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1171](jdx/hk#1171)
- **(builtins)** add kingfisher secret scanner by [@&#8203;thoroc](https://github.com/thoroc) in [#&#8203;1160](jdx/hk#1160)
- **(builtins)** classify command effects by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1167](jdx/hk#1167)
- **(check)** add normalized diagnostics and SARIF by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1168](jdx/hk#1168)
- **(mcp)** expose hk to coding agents by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1169](jdx/hk#1169)
- **(mcp)** add interactive hk dashboard by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1170](jdx/hk#1170)
- **(run)** add agent-friendly execution scoping by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1162](jdx/hk#1162)
- **(run)** add structured execution results by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1163](jdx/hk#1163)
- **(step)** add command effect safety by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1166](jdx/hk#1166)

##### πŸ› Bug Fixes

- **(check)** exclude deleted paths from ref checks by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1177](jdx/hk#1177)
- **(docs)** keep search modal above site navigation by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1188](jdx/hk#1188)
- **(step)** support argv prefixes for structured commands by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1175](jdx/hk#1175)

##### πŸ§ͺ Testing

- **(init)** decouple agent docs assertion from releases by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1187](jdx/hk#1187)

##### πŸ“¦οΈ Dependency Updates

- lock file maintenance by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1151](jdx/hk#1151)
- simplify cargo version requirements by [@&#8203;jdx](https://github.com/jdx) in [#&#8203;1161](jdx/hk#1161)
- lock file maintenance by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1173](jdx/hk#1173)
- update zizmorcore/zizmor-action action to v0.6.2 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1180](jdx/hk#1180)
- update jdx/mise-action action to v4.2.4 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1179](jdx/hk#1179)
- update anthropics/claude-code-action action to v1.0.184 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1178](jdx/hk#1178)
- update dependency [@&#8203;testing-library/jest-dom](https://github.com/testing-library/jest-dom) to v7 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1182](jdx/hk#1182)
- update dependency jsdom to v30 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1183](jdx/hk#1183)
- update dependency typescript to v7 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1184](jdx/hk#1184)
- update jdx/mise-action action to v4.2.4 by [@&#8203;renovate\[bot\]](https://github.com/renovate\[bot]) in [#&#8203;1181](jdx/hk#1181)

##### New Contributors

- [@&#8203;thoroc](https://github.com/thoroc) made their first contribution in [#&#8203;1160](jdx/hk#1160)

</details>

---

### Configuration

πŸ“… **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

β™» **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants