A project to enable automatic resolution and reopening of Secret Scanning alerts on GitHub Enterprise Server

Functionality:

• Given two Secret Scanning pattern names, new and old, resolve open new alerts that overlap with resolved old alerts while preserving the triage state of the old alert.
• Given a CSV file which specifies alerts in owner,repo,secret_alert_number format, reopen the specified alerts.

To use this CLI you need:

• An instance of GHES.
• Administrator credentials to the instance.
• A personal access token for the administrative user with all scopes.

Run go build to build the CLI. You can then run the CLI using the snippet below:

./ghes-secret-scanning-script create \
--url="YOUR_INSTANCE_URL" \
--pat="YOUR_ADMIN_USER_PAT" \
--enterprise-id="YOUR_ENTERPRISE_ID" \
--new-pattern="YOUR_NEW_PATTERN_ID" \
--old-pattern="YOUR_OLD_PATTERN_ID" \
--alerts-to-reopen-csv="PATH_TO_CSV" \
--dry-run="true/false" \
--new-substring-regex="REGEX" \
--old-substring-regex="REGEX"

Instead of specifying --enterprise-id, specify --organization-ids as a comma-delimited list of organization (e.g. --organization-ids="org1,org2").

Instead of specifying --enterprise-id, specify --repository-ids as a comma-delimited list of repositories in org/repo format (e.g. --repository-ids="org1/repo1,org1/repo2,org2/repo1").

Either an input CSV path, both new and old patterns, or all three may be specified.

Alternatively, specify your PAT via the $GITHUB_TOKEN env var.