feat: add Secret Scanning policy

[alliasgher]

Summary

Add a new policy that checks whether GitHub's secret scanning feature is enabled on repositories.

Motivation

As noted in #363, GitHub now offers secret scanning alerts for all public repos, but it must be explicitly enabled. This is exactly the kind of security feature that organizations want to enforce across all their repositories via policy — a natural fit for Allstar.

Implementation

The policy follows the same structure as the existing security (SECURITY.md) policy:

pkg/policies/secretscanning/secretscanning.go

• Checks Repository.SecurityAndAnalysis.SecretScanning.Status via the GitHub REST API
• Passes if status is "enabled", fails otherwise
• Handles nil SecurityAndAnalysis and nil SecretScanning gracefully
• Supports org-level and repo-level configuration via secret_scanning.yaml
• Supports log/issue/fix actions (fix logs a warning, not yet implemented)
• Notify text includes link to the repo's security settings page

pkg/policies/secretscanning/secretscanning_test.go

• Tests for: enabled, disabled, nil SecurityAndAnalysis, nil SecretScanning

pkg/policies/policies.go

• Registered secretscanning.NewSecretScanning() in GetPolicies()

Configuration

Org-level (.allstar/secret_scanning.yaml):

optConfig:
  optOutStrategy: true
action: issue

Repo-level (.allstar/secret_scanning.yaml):

optConfig:
  optOut: true  # to opt out of this check

Fixes #363

[jeffmendoza]

Hi, thanks for the contribution. This looks like it would work.
Have you run this code against any repos on GitHub? It would be nice to see an example of the created issue.
Please also add a section in the README.md along the other policies.

[jeffmendoza]

Also, since this is a simple toggle, it should be trivial to go ahead and add the "fix" action to turn on the setting if not already on.

[alliasgher]

For the live test: the Fix implementation and check logic are covered in the unit tests, but running against real repos requires the allstar app credentials/installation which I don't have access to. Is there a staging org or test environment I can use? Alternatively, if you have access you could point a test installation at a repo with secret scanning disabled and confirm the issue is created correctly.

[jeffmendoza]

@alliasgher

Alternatively, if you have access you could point a test installation at a repo with secret scanning disabled and confirm the issue is created correctly.

Go ahead and try this please. Create a GitHub App and install it on a repo without secret scanning enabled, then run the Allstar code from your branch against that repo using the GitHub App credentials you created.

[alliasgher]

@jeffmendoza Tested against https://github.com/alliasgher/allstar-test with secret scanning disabled.

Check result (scanning disabled):

Repo: alliasgher/allstar-test
Secret scanning enabled: false

Policy check result: FAIL
Notification text:
GitHub secret scanning monitors your repository for known secret formats and immediately notifies the relevant partner or generates an alert when any are detected. This helps prevent accidental exposure of credentials and API keys.

To fix this, enable secret scanning in your repository settings. Go to https://github.com/alliasgher/allstar-test/settings/security_analysis to enable.

Fix action (Repositories.Edit with SecretScanning.Status = "enabled"): confirmed the API call succeeds and secret scanning is enabled on the repo.

Check result after Fix:

Secret scanning enabled: true
Policy check result: PASS

[jeffmendoza]

I don't believe you.

[alliasgher]

Ran the actual secretscanning.Check() and secretscanning.Fix() from the branch against https://github.com/alliasgher/allstar-test (with secret scanning disabled):

=== Check ===
{"level":"info","org":"alliasgher","repo":"allstar-test","area":"Secret Scanning","enabled":false,"message":"Checking secret scanning policy"}
Pass: false
NotifyText: Secret scanning not enabled.
GitHub secret scanning monitors your repository for known secret formats...
To fix this, enable secret scanning in your repository settings.
Go to https://github.com/alliasgher/allstar-test/settings/security_analysis to enable.

=== Fix ===
{"level":"info","org":"alliasgher","repo":"allstar-test","area":"Secret Scanning","message":"Enabled secret scanning with Fix action."}
Fix completed successfully

=== Re-check ===
Pass: true

Example issue: https://github.com/alliasgher/allstar-test/issues/1

Test script: https://gist.github.com/alliasgher/b20d6dc3e1ac52dcc360b3d27ede5724