Secret scanning on push
When secret scanning on push is on for your workspace, Loha scans every commit you push to a connected repository for secrets such as cloud access keys, tokens and private keys. It reads the whole tree of the pushed commit. It never runs your code.
What you see
| Where | What happens |
|---|---|
| The commit and its merge request | A loha/secret-scan check: pending while Loha scans, green when it found no open secret, red with the number of secrets it found |
| Security issues | For a push to your default branch or a protected ref: one issue per secret (its rule in its file), category Secret |
| Email and Teams | For a push to your default branch or a protected ref: one message per push listing the new secrets, whatever their severity |
| Builds in Enforce | A build of a commit with an open secret issue is refused before it runs, with a link to the issue |
A push to any other branch still gets the check, but opens no issue and sends no message. That is the same rule as for every security issue, so a feature branch never flips an issue between fixed and reopened.
When it runs
- Secret scanning on push and security issues are both on for the workspace.
- Build Security is in Observe or Enforce. In Off, nothing is scanned.
- The repository has a webhook trigger, or is connected through the GitHub App. A trigger's own branch and path filters do not matter: every branch push is scanned, even one that starts no build.
- Pushing the same commit to the same branch again does not scan it again. Pushing it to another branch does.
Fix a secret
- Rotate the secret first. Removing it from your code does not undo the leak: it is still in your Git history and in every clone.
- Remove it from your code and push. The check turns green, and on your default branch the issue closes as Fixed.
- If the finding is not a real secret, ask an administrator to mark the issue False positive. For a secret this needs a second administrator to approve (see Triage). The next push is then green, and builds are no longer refused.
Enforce
In Enforce, Loha refuses a build when an open secret issue of the repository was
seen in the build's exact commit. The build fails at once with
SECRET_DETECTED_AT_REVISION and a link to the issue, on the build page and in
loha build get. The refusal covers only the branches your policy protects (every
branch when the policy names none). It follows the issue: once the issue is fixed or
triaged, builds of that commit run again. Rotating the secret is what actually protects
you.
The scan of a push finishes after the build that same push started has already been planned, so that first build is not refused by this check (your policy's own secret threshold, if any, still applies to it). Every later build of the commit — a re-run, a retry or a deploy build — is refused while the issue stays open.
What this does not do
- It scans the newest commit of each push only. A secret added and removed again within one push is not found.
- It does not reject the push. On Loha Repos, a pre-receive check is planned.
- It does not rotate or revoke secrets for you.
- A scan that could not finish shows a red "could not finish" check. Push a new commit to scan again.