cncf-migration-secrets-scrubber

name	cncf-migration-secrets-scrubber
description	Scan and strip hardcoded secrets, internal credentials, corporate hostnames, and proprietary naming from a GitHub Enterprise repo before it goes public. Specific to the Vionix CNCF migration workflow — do not use for general code review.

When to Use This Skill

Use this skill when:

• Preparing an internal GHES repository for public release on github.com
• Verifying that a migration commit contains no leaked credentials or internal hostnames
• Auditing .migrate/scrub.py replacement rules for completeness

Do NOT use for general code scanning unrelated to an OSS migration.

Tools Required

# Install once (macOS)
brew install trufflehog gitleaks

# Verify
trufflehog --version
gitleaks version

Step 1 — Scan Commit History for Secrets

Run both scanners against the source GHES repo (before migration) and the destination public repo (after migration, to confirm nothing leaked through):

# In the source GHES repo clone
cd /path/to/source-ghes-repo

# TruffleHog — detects verified and unverified secrets across full git history
trufflehog git file://. --no-update --fail

# Gitleaks — pattern-based scan of working tree and history
gitleaks detect --source . --redact

# Expected: zero findings on a clean migration

If findings appear:

1. Identify the file and commit that introduced the secret.
2. Add the pattern to .migrate/scrub.py REPLACEMENTS list.
3. Re-run the migration extract step for the affected milestone.
4. Re-verify.

Step 2 — Content Scrubbing with scrub.py

The .migrate/scrub.py script applies an ordered regex replacement table to every in-scope file extracted from the GHES repo via git archive.

Critical ordering rules

# ALWAYS put more-specific patterns BEFORE general ones
# Wrong order — partial match fires first:
(r"artifactory\.viasat\.com",                  "<artifactory-host>"),   # fires first
(r"[a-zA-Z0-9-]+\.docker\.artifactory\.viasat\.com", "<docker-registry>"),  # never fires

# Correct order:
(r"[a-zA-Z0-9-]+\.docker\.artifactory\.viasat\.com", "<docker-registry>"),  # fires first
(r"artifactory\.viasat\.com",                  "<artifactory-host>"),   # catches remainder

Categories to cover in REPLACEMENTS

Category	Example pattern	Replacement
Repo self-reference	your-org/your-repo	PublicOrg/public-repo
GHES mirror orgs	ghes-org/external-org-external-repo	external-org/external-repo
Internal Docker registries	*.docker.artifactory.corp.com	<docker-registry>
Artifact repositories	artifactory.corp.com	<artifactory-host>
Internal hostnames	*.corp.internal	<corp-host>
Corporate emails	[e-mail]	[e-mail]
Slack channel IDs	C030G9HK4G2	<slack-channel-id>
Issue tracker refs	PROJ-1234	(empty string)
Internal branch refs	@feature//my-feature	@main
Branding strings	Internal Platform Name	Public Project Name

Running the scrubber

# Extract and scrub a specific git ref into the destination repo
python3 .migrate/scrub.py <source-ref>

# Verify no internal terms remain after scrub
grep -rn "viasat\|\.internal\|corp\.com" .github/ actions/ products/ \
  --include="*.yaml" --include="*.yml" --include="*.md" \
  | grep -v "# .*placeholder\|<.*>"

Step 3 — Post-Migration Verification Checklist

Run after each milestone commit is built:

# 1. No secrets
trufflehog git file://. --no-update --fail
gitleaks detect --source . --redact

# 2. No internal hostnames in tracked files
grep -rn "\.viasat\.com\|\.viasat\.io\|\.corp\." \
  .github/ actions/ products/ skills/ docs/ \
  | grep -v "<.*>"   # placeholders are OK

# 3. No corporate emails
grep -rn "@viasat\.com" .github/ actions/ products/ \
  | grep -v "@example\.com"

# 4. No <your-org> placeholders left unresolved
grep -rn "<your-org>" .github/ actions/ products/

Vionix-specific GHES Mirror Org Decode Rules

The source GHES had three internal mirror orgs encoding external action origins:

GHES pattern	Decoded origin
github/<org>-<repo>	<org>/<repo> on github.com
viarise/<action>	actions/<action> (GitHub official) or upstream
seceng-devsecops-platform/<org>-<repo>	<org>/<repo> if org exists publicly
seceng-devsecops-platform/<custom-action>	Viasat/vionix/actions/... (Viasat-built)

Decode rule: if the external org exists on github.com → use <org>/<repo> directly. If it is a custom Viasat Docker action → bring it into actions/ as a first-class vionix action.

Related Skills

• cncf-migration-author-mapper — scrub author identities from git history
• cncf-migration-ghes-to-github — mirror push and branch protection