Merge pull request #657 from softlayer/issues656

Added secrets baseline, and github action build job

.github/workflows/build.yml

@@ -13,8 +13,24 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Build Hugo
       run: |
         mkdir html
-        ./bin/hugo -d html -v
+        ./bin/hugo -d html -v
+  detectsecrets:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python
+      uses: actions/setup-python/@v5
+      with:
+        python-version: 3.11
+    - name: Install Detect Secrets
+      run: |
+        python -m pip install --upgrade pip
+        pip install --upgrade "git+https://github.com/ibm/detect-secrets.git@master#egg=detect-secrets"
+    - name: Detect Secrets
+      run: |
+        detect-secrets scan --update .secrets.baseline
+        detect-secrets audit .secrets.baseline --report --fail-on-unaudited --omit-instructions

.pre-commit-config.yaml

@@ -0,0 +1,21 @@
+# This is an example configuration to enable detect-secrets in the pre-commit hook.
+# Add this file to the root folder of your repository.
+#
+# Read pre-commit hook framework https://pre-commit.com/ for more details about the structure of config yaml file and how git pre-commit would invoke each hook.
+#
+# This line indicates we will use the hook from ibm/detect-secrets to run scan during committing phase.
+repos:
+  - repo: https://github.com/ibm/detect-secrets
+    # If you desire to use a specific version of detect-secrets, you can replace `master` with other git revisions such as branch, tag or commit sha.
+    # You are encouraged to use static refs such as tags, instead of branch name
+    #
+    # Running "pre-commit autoupdate" automatically updates rev to latest tag
+    rev: 0.13.1+ibm.62.dss
+    hooks:
+      - id: detect-secrets # pragma: whitelist secret
+        # Add options for detect-secrets-hook binary. You can run `detect-secrets-hook --help` to list out all possible options.
+        # You may also run `pre-commit run detect-secrets` to preview the scan result.
+        # when "--baseline" without "--use-all-plugins", pre-commit scan with just plugins in baseline file
+        # when "--baseline" with "--use-all-plugins", pre-commit scan with all available plugins
+        # add "--fail-on-unaudited" to fail pre-commit for unaudited potential secrets
+        args: [--baseline, .secrets.baseline, --use-all-plugins]