GitHub Secret Scanning

# REST
gh api /repos/{owner}/{repo}/secret-scanning/alerts --paginate > alerts.json

# Or GraphQL when you want only specific fields
gh api graphql --paginate -F owner=$OWNER -F repo=$REPO -f query='
  query($owner:String!, $repo:String!, $cursor:String) {
    repository(owner:$owner, name:$repo) {
      secretScanningAlerts(first:100, after:$cursor, states:[OPEN]) {
        pageInfo { hasNextPage endCursor }
        nodes {
          number
          state
          secretType
          secretTypeDisplayName
          createdAt
          publiclyLeaked
        }
      }
    }
  }' > alerts.json

# Active partner tokens — start here
jq '[.[] | select(.state == "open" and .validity == "active") | {
       number,
       type: .secret_type,
       leaked: .publicly_leaked,
       commit: .locations[0].details.commit_sha,
       path: .locations[0].details.path
     }]' alerts.json

# Group by secret type to plan rotation work
jq '[.[] | select(.state == "open") | {type: .secret_type}]
    | group_by(.type)
    | map({type: .[0].type, count: length})
    | sort_by(-.count)' alerts.json

# Bypassed Push Protection — incidents in disguise
jq '.[] | select(.push_protection_bypassed == true)' alerts.json

# Validity check for everything — feeds into priority decisions
jq '.[] | {number, type: .secret_type, validity, state}' alerts.json

# 1. For partner tokens, check validity first
gh api /repos/{owner}/{repo}/secret-scanning/alerts/<number> --jq '.validity'

# 2. Rotate at the issuer (varies per partner)

# 3. Mark resolved on GitHub so the alert closes
gh api -X PATCH /repos/{owner}/{repo}/secret-scanning/alerts/<number> \
  -F state=resolved -F resolution=revoked

# 4. Purge from history
gh api /repos/{owner}/{repo}/secret-scanning/alerts/<number>/locations \
  --jq '.[].details.commit_sha' | sort -u > commits-to-purge.txt
git filter-repo --replace-text replacements.txt   # or path-based

# 5. Enable Push Protection at the org level if not already
gh api -X PATCH /orgs/{org} \
  -F secret_scanning_push_protection_enabled_for_new_repositories=true

{
  "number": 88,
  "state": "open",
  "secret_type": "github_personal_access_token",
  "secret_type_display_name": "GitHub Personal Access Token",
  "validity": "active",
  "publicly_leaked": true,
  "push_protection_bypassed": false,
  "locations": [{
    "type": "commit",
    "details": {
      "path": ".env.local",
      "commit_sha": "abc1234def5678",
      "blob_sha": "9abcdef0",
      "start_line": 3
    }
  }]
}

# Get the token ID (from gh's own auth records, not the leaked token)
gh auth status

# Revoke via the API — the token itself isn't in the alert payload,
# you read it from .env.local before deleting:
LEAKED=$(grep '^GITHUB_TOKEN=' .env.local | cut -d= -f2)
# Revoke through Settings UI: github.com/settings/tokens → find by leaked
# prefix → Revoke. Or for fine-grained PATs: /settings/personal-access-tokens.

# Mark the alert resolved
gh api -X PATCH /repos/{owner}/{repo}/secret-scanning/alerts/88 \
  -F state=resolved -F resolution=revoked

# Purge from history
git filter-repo --path .env.local --invert-paths --force
git push --force-with-lease origin main

# Scan history for related leaks
gitleaks detect --log-opts="--all" --redact --report-path gitleaks-history.json

# Add .env* to .gitignore + enable Push Protection at the org level
echo '.env*' >> .gitignore

# Resolve the alert as 'used in tests'
gh api -X PATCH /repos/{owner}/{repo}/secret-scanning/alerts/<number> \
  -F state=resolved -F resolution=used_in_tests \
  -F resolution_comment='Documented example token from tests/fixtures/'