Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: convert HTTP to SSH source when using deploy key on GitHub #2568

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

matpratta
Copy link

This PR aims to improve the overall user experience by handling cases when an HTTP(S) Git URL is provided instead of an SSH one, for deployments using Deploy Key.

The incorrect URL is parsed and converted into an SSH one, based on the currently attributed "source".
Currently, GitHub is supported but should be very straightforward to expand for other providers too.

Somewhat related to my earlier issue #2563 as that was what originally caused it, though the issue itself should have been fixed on PR #2567.

@andrasbacsai andrasbacsai self-assigned this Jun 19, 2024
Copy link

gitguardian bot commented Sep 19, 2024

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
- - GitHub App Keys ccbbfd8 database/seeders/GithubAppSeeder.php View secret
- - Generic Password e1bcae7 templates/compose/resend.yaml View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secrets safely. Learn here the best practices.
  3. Revoke and rotate these secrets.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants