skkammar/SecretShield
Scans every push and PR for secrets, .env files, and sensitive credentials. Auto-removes on push, blocks merge on PR.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | GitHub token for PR comments and artifact upload | yes | ${{ github.token }} |
| auto_remove | Auto-delete sensitive files on direct push | no | true |
| fail_on_secrets | Fail the job if secrets are found (blocks PR merge) | no | true |
| custom_patterns | Comma-separated extra regex patterns to scan for | no | "" |
| ignore_paths | Comma-separated paths to skip (e.g. tests/,docs/) | no | "" |
| severity_threshold | Minimum severity to fail on: LOW, MEDIUM, HIGH, CRITICAL | no | HIGH |
Outputs
| name | description |
|---|---|
| secrets_found | true/false — whether any secrets were detected |
| report_path | Path to the JSON scan report artifact |
| total_findings | Total number of findings across all rules |