run-secrets-detection.yml

name: Secrets Detection
on: pull_request

jobs:
  secrets_detection:
    runs-on: ubuntu-latest
    if: github.repository == 'demisto/content' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]'
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v3
        with:
          python-version: '3.8'
      - name: Setup Poetry
        uses: Gr1N/setup-poetry@v7
      - name: Install Python Dependencies
        run: |
          poetry install --with ci
      - name: Run Secrets Detection
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BRANCH_NAME: ${{ github.head_ref }}
          USERNAME: ${{ secrets.SECRET_CHECK_USER }}
          PASSWORD: ${{ secrets.SECRET_CHECK_PASS }}
        run: |
          echo "Run secrets detection for PR: $PR_NUMBER on branch: $BRANCH_NAME"
          investigation_id=$(poetry run Utils/github_workflow_scripts/run_secrets_detection.py --pr_number $PR_NUMBER --branch_name $BRANCH_NAME --username $USERNAME --password $PASSWORD)
          echo "INVESTIGATION_ID=$investigation_id" >> $GITHUB_ENV
      - name: Wait For Playbook To Finish
        env:
          GOLD_API_KEY: ${{ secrets.SECRETS_GOLD_API_KEY }}
        run: |
          echo "Invastigation id is: $INVESTIGATION_ID "
          poetry run python ./Utils/github_workflow_scripts/run_secrets_detection_get_playbook_status.py -i $INVESTIGATION_ID -k $GOLD_API_KEY