Update overview.mdx

add telemetry for cloud secret scanning
2025-03-17 15:08:32 +00:00 · 2023-07-17 21:11:27 -04:00 · 2023-07-17 20:29:20 -04:00 · 2023-07-17 20:29:07 -04:00 · 2023-07-17 20:20:11 -04:00 · 2023-07-17 19:56:07 -04:00
8 changed files with 28 additions and 98 deletions
--- a/.github/workflows/build-staging-img.yml
+++ b/.github/workflows/build-staging-img.yml
@ -105,36 +105,6 @@ jobs:
          platforms: linux/amd64,linux/arm64
          build-args: |
            POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-
-  secret-scanning-git-app:
-    name: Build secret scanning git app
-    runs-on: ubuntu-latest
-    steps:
-      - name: ☁️ Checkout source
-        uses: actions/checkout@v3
-      - name: Save commit hashes for tag
-        id: commit
-        uses: pr-mpt/actions-commit-hash@v2
-      - name: 🔧 Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: 🐋 Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Set up Depot CLI
-        uses: depot/setup-action@v1
-      - name: 🏗️ Build secret scanning git app and push
-        uses: depot/build-push-action@v1
-        with:
-          project: 64mmf0n610
-          push: true
-          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          context: secret-engine
-          tags: |
-            infisical/staging_deployment_secret-scanning-git-app:${{ steps.commit.outputs.short }}
-            infisical/staging_deployment_secret-scanning-git-app:latest
-          platforms: linux/amd64,linux/arm64
  gamma-deployment:
    name: Deploy to gamma
    runs-on: ubuntu-latest
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@ -41,8 +41,8 @@ import {
  signup as v1SignupRouter,
  userAction as v1UserActionRouter,
  user as v1UserRouter,
-  workspace as v1WorkspaceRouter,
-  webhooks as v1WebhooksRouter
+  webhooks as v1WebhooksRouter,
+  workspace as v1WorkspaceRouter
 } from "./routes/v1";
 import {
  auth as v2AuthRouter,
--- a/backend/src/services/GithubSecretScanningService.ts
+++ b/backend/src/services/GithubSecretScanningService.ts
@ -9,6 +9,7 @@ import MembershipOrg from "../models/membershipOrg";
 import { ADMIN, OWNER } from "../variables";
 import User from "../models/user";
 import { sendMail } from "../helpers";
+import TelemetryService from "./TelemetryService";

 type SecretMatch = {
  Description: string;
@ -127,15 +128,6 @@ export default async (app: Probot) => {

    const adminOrOwnerEmails = userEmails.map(userObject => userObject.email)

-
-    // TODO
-    // don't notify if the risk is marked as false positive
-
-    // loop through each finding and check if the finger print without commit has a status of false positive, if so don't add it to the list of risks that need to be notified 
-
-
-
-
    await sendMail({
      template: "secretLeakIncident.handlebars",
      subjectLine: `Incident alert: leaked secrets found in Github repository ${repository.full_name}`,
@ -146,6 +138,18 @@ export default async (app: Probot) => {
        pusher_name: pusher.name
      }
    });
+
+    const postHogClient = await TelemetryService.getPostHogClient();
+    if (postHogClient) {
+      postHogClient.capture({
+        event: "cloud secret scan",
+        distinctId: pusher.email,
+        properties: {
+          numberOfCommitsScanned: commits.length,
+          numberOfRisksFound: Object.keys(allFindingsByFingerprint).length,
+        }
+      });
+    }
  });
 };

--- a/backend/src/templates/secretLeakIncident.handlebars
+++ b/backend/src/templates/secretLeakIncident.handlebars
@ -10,13 +10,14 @@
 <body>
  <h3>Infisical has uncovered {{numberOfSecrets}} secret(s) from your recent push</h3>
  <p><a href="https://app.infisical.com/secret-scanning"><strong>View leaked secrets</strong></a></p>
-  <p>One or more secret leaks have been detected in a recent commit pushed by {{pusher_name}} ({{pusher_email}}). If
+  <p>You are receiving this notification because one or more secret leaks have been detected in a recent commit pushed
+    by {{pusher_name}} ({{pusher_email}}). If
    these are test secrets, please add `infisical-scan:ignore` at the end of the line containing the secret as comment
-    in the given programming. This will prevent future notifications from being sent out for the given secret(s).</p>
+    in the given programming. This will prevent future notifications from being sent out for those secret(s).</p>

  <p>If these are production secrets, please rotate them immediately.</p>

-  <p>Once you have taken action, be sure to update the status of the risk in your<a
+  <p>Once you have taken action, be sure to update the status of the risk in your <a
      href="https://app.infisical.com/">Infisical
      dashboard</a>.</p>
 </body>
--- a/docs/self-hosting/overview.mdx
+++ b/docs/self-hosting/overview.mdx
@ -8,7 +8,7 @@ Self-hosted Infisical allows you to maintain your sensitive information within y
 Choose from a variety of deployment options listed below to get started.

 <Card
-  title="Kubernetes"
+  title="Kubernetes (recommended)"
  color="#ea5a0c"
  href="deployment-options/kubernetes-helm"
 >
--- a/helm-charts/infisical/Chart.yaml
+++ b/helm-charts/infisical/Chart.yaml
@ -7,7 +7,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.2.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/helm-charts/infisical/templates/ingress.yaml
+++ b/helm-charts/infisical/templates/ingress.yaml
@ -44,6 +44,13 @@ spec:
              name: {{ include "infisical.backend.fullname" . }}
              port:
                number: 4000
+        - path: /ss-webhook
+          pathType: Exact
+          backend:
+            service:
+              name: {{ include "infisical.backend.fullname" . }}
+              port:
+                number: 4000
      {{- if $ingress.hostName }}
      host: {{ $ingress.hostName }}
      {{- end }}
--- a/helm-charts/infisical/values.yaml
+++ b/helm-charts/infisical/values.yaml
@ -169,53 +169,6 @@ backendEnvironmentVariables:
  ##
  MONGO_URL: ""

-secretScanningGitApp:
-  ## @param backend.enabled Enable git scanning app
-  ##
-  enabled: false
-  ## @param backend.name Backend name
-  ##
-  name: secret-scanning-git-app
-  ## @param backend.fullnameOverride Backend fullnameOverride
-  ##
-  fullnameOverride: ""
-  ## @param backend.podAnnotations Backend pod annotations
-  ##
-  podAnnotations: {}
-  ## @param backend.deploymentAnnotations Backend deployment annotations
-  ##
-  deploymentAnnotations: {}
-  ## @param backend.replicaCount Backend replica count
-  ##
-  replicaCount: 2
-  ## Backend image parameters
-  ##
-  image:
-    ## @param backend.image.repository Backend image repository
-    ##
-    repository: infisical/staging_deployment_secret-scanning-git-app
-    ## @param backend.image.tag Backend image tag
-    ##
-    tag: "latest"
-    ## @param backend.image.pullPolicy Backend image pullPolicy
-    ##
-    pullPolicy: IfNotPresent
-  ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars))
-  ##
-  kubeSecretRef: ""
-  ## Backend service
-  ##
-  service:
-    ## @param backend.service.annotations Backend service annotations
-    ##
-    annotations: {}
-    ## @param backend.service.type Backend service type
-    ##
-    type: ClusterIP
-    ## @param backend.service.nodePort Backend service nodePort (used if above type is `NodePort`)
-    ##
-    nodePort: ""
-
 ## @section MongoDB(&reg;) parameters
 ## Documentation : https://github.com/bitnami/charts/blob/main/bitnami/mongodb/values.yaml
 ##
@ -374,11 +327,6 @@ ingress:
  backend:
    path: /api
    pathType: Prefix
-  ## @skip ingress.backend
-  ##
-  secretScanningGitApp:
-    path: /git-app-api
-    pathType: Prefix
  ## @param ingress.tls Ingress TLS hosts (matching above hostName)
  ## Replace with your own domain
  ##
Author	SHA1	Message	Date
Maidul Islam	f37b497e48	Update overview.mdx	2023-07-17 21:11:27 -04:00
Maidul Islam	0d2e55a06f	add telemetry for cloud secret scanning	2023-07-17 20:29:20 -04:00
Maidul Islam	040243d4f7	add telemetry for cloud secret scanning	2023-07-17 20:29:07 -04:00
Maidul Islam	c450b01763	update email for secret leak	2023-07-17 20:20:11 -04:00
Maidul Islam	4cd203c194	add ss-webhook to values file k8-infisical	2023-07-17 19:56:07 -04:00
Maidul Islam	178d444deb	add web hook under api temporarily	2023-07-17 18:58:39 -04:00
Maidul Islam	139ca9022e	Update build-staging-img.yml	2023-07-17 17:36:57 -04:00
Maidul Islam	34d3e80d17	Merge pull request #743 from Infisical/git-scanning-app bring back secret engine for dev	2023-07-17 17:21:34 -04:00