Create a Guide/Template: Preventing Secrets & Credentials Leaks in GitHub

[gregpawin]

Overview

We need to create a guide to preventing secrets and credentials from being published on GitHub.

Action Items

The phases in the guide-making process are listed below. Each phase displayed in blue is linked to a wiki page with instructions on how to complete that phase. Open the wiki page in a new tab, copy the instructions for each part into the section labeled 'Tasks' at the bottom of this issue, and complete each task listed.

• Gather Examples Solo (open in a new tab)
• Gather Examples Collaboratively
• Create a Guide Draft
  • If needed, create a template
• Have your guide peer reviewed
• Present your guide for leadership review

Resources

Projects with no mention of "secrets" and/or "credentials" in their Contributing.md or README.md file:

• 100 Automations
• 311 Data
• Access the Data
• BallotNav
• Civic Opportunity Project
• Civic Tech Index
• Civic Tech Structure
• Engage
• Expunge-Assist (formerly known as Record Clearance)
• Food Oasis

Projects to check

• Brigade Organizer's Playbook
• Civic Tech Jobs
• Data Science Projects
• Design Systems
• GreenEarthOS
• Guides
• HomeUniteUs
• Internship project
• Lucky Parking
• Open Community Survey
• TDM Calculator
• VRMS
• Hack for LA's Website
• Youth Justice Nav

Tasks

• This is where you will copy instructions from the wiki page for the step you are currently on.

[ExperimentsInHonesty]

@salice
Can you share with us:

• how much time was used recovering from pete's homeuniteus pr that published his .env file to AWS account.
• Are there any others that you know about and how long each of them took (I think the other one might be lucky parking).

[gregpawin]

When I published the Lucky Parking secrets, I got the warning within minutes and fixed it right away, which included killing the old credentials and creating new ones.

[ExperimentsInHonesty]

@gregpawin how long did the clean up take? https://github.com/hackforla/engineering/issues/17#issuecomment-891511226

[gregpawin]

It took less than 30 mins

[ExperimentsInHonesty]

sophias repo with pre commit hooks
https://github.com/100Automations/github-actions
https://github.com/100Automations/pre-commit-hooks

[Aditya23soni]

Prior version of issue

Overview

We need to create a guide to preventing secrets and credentials from being published on GitHub.

Action Items

• Gather examples of how other projects have done it, adding each example as a link in the resources section
  • Once done, remove the "TG: Gather Examples" label and add the "TG: Draft Template" label
• Create a draft template, either in markdown format in this issue or a google doc in the Engineering google drive
  • Once done, remove the "TG: Draft Template" label and add the "TG: Create Guide" label
• Create a guide on how to use the template
  • Once done, remove the "TG: Create Guide" label and add the "TG: Review Guide" label
• Review the guide with product management communities of practice
  • Once done, remove the "TG: Review Guide" label and add the "TG: Leadership Review" label
• Present to Hack for LA leadership team for sign off
  • Once approved, remove the "TG: Leadership Review" label and add the "TG: Place Guide" label
• Possibly create an issue template on .github
  • Include link to template under resources if you add it as a template in .github

Resources

Update tracker issue (TBD) with the name of item you are working

Projects with no mention of "secrets" and/or "credentials" in their Contributing.md or README.md file:

• 100 Automations
• 311 Data
• Access the Data
• BallotNav
• Civic Opportunity Project
• Civic Tech Index
• Civic Tech Structure
• Engage
• Expunge-Assist (formerly known as Record Clearance)
• Food Oasis

Projects to check

• Brigade Organizer's Playbook
• Civic Tech Jobs
• Data Science Projects
• Design Systems
• GreenEarthOS
• Guides
• HomeUniteUs
• Internship project
• Lucky Parking
• Open Community Survey
• TDM Calculator
• VRMS
• Hack for LA's Website
• Youth Justice Nav

[Aditya23soni]

Assignee, Labels, Project Board Placement, and Milestones for this issue in the Ops Repo: