From 4bdeefc2c0f3585074875cbf3508f3f72ffab559 Mon Sep 17 00:00:00 2001
From: alok-cstk <alok.shukla@contentstack.com>
Date: Fri, 30 Oct 2026 18:07:14 +0530
Subject: [PATCH] Add GitGuardian secret scan on publish (postpack hook,
 blocking); install ggshield in release workflow (IS-7341)

---
 .github/workflows/beta-release-package.yml        | 8 ++++++++
 .github/workflows/npm-publish-github-packages.yml | 5 +++++
 .github/workflows/npm-publish.yml                 | 5 +++++
 .gitignore                                        | 1 +
 package.json                                      | 3 ++-
 5 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/beta-release-package.yml b/.github/workflows/beta-release-package.yml
index 7371c6a1..10a7f480 100644
--- a/.github/workflows/beta-release-package.yml
+++ b/.github/workflows/beta-release-package.yml
@@ -14,6 +14,8 @@ jobs:
               with:
                   node-version: 14
             - run: npm ci
+            - name: Install ggshield
+              run: pipx install ggshield
             - run: npm test
         name: Build and test
 
@@ -30,8 +32,11 @@ jobs:
                   node-version: 14
                   registry-url: https://npm.pkg.github.com/
             - run: npm ci
+            - name: Install ggshield
+              run: pipx install ggshield
             - run: npm publish --tag beta
               env:
+                  GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
                   NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
         name: Publish to GitHub
 
@@ -45,8 +50,11 @@ jobs:
                 node-version: 16
                 registry-url: https://registry.npmjs.org/
             - run: npm ci
+            - name: Install ggshield
+              run: pipx install ggshield
             - run: npm publish --tag beta
               env:
+                GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
                 NODE_AUTH_TOKEN: ${{secrets.APP_SDK_AUTOMATION}}
         name: Publish to NPM
 
diff --git a/.github/workflows/npm-publish-github-packages.yml b/.github/workflows/npm-publish-github-packages.yml
index d2fd4fbb..4312357a 100644
--- a/.github/workflows/npm-publish-github-packages.yml
+++ b/.github/workflows/npm-publish-github-packages.yml
@@ -16,6 +16,8 @@ jobs:
               with:
                   node-version: 18
             - run: npm ci
+            - name: Install ggshield
+              run: pipx install ggshield
             - run: npm test
 
     publish-gpr:
@@ -31,6 +33,9 @@ jobs:
                   node-version: 18
                   registry-url: https://npm.pkg.github.com/
             - run: npm ci
+            - name: Install ggshield
+              run: pipx install ggshield
             - run: npm publish
               env:
+                  GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
                   NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
\ No newline at end of file
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 339f531b..8d71f780 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -16,6 +16,8 @@ jobs:
         with:
           node-version: 18
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - run: npm test
 
   publish-npm:
@@ -28,6 +30,9 @@ jobs:
           node-version: 18
           registry-url: https://registry.npmjs.org/
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - run: npm publish
         env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
           NODE_AUTH_TOKEN: ${{secrets.APP_SDK_AUTOMATION}}
diff --git a/.gitignore b/.gitignore
index 39f16a4d..65494a1d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -141,3 +141,4 @@ jsdocs/
 !.vscode/launch.json
 !.vscode/extensions.json
 *.code-workspace
+.cache_ggshield
diff --git a/package.json b/package.json
index 13c2068e..fe40a818 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,8 @@
     "main": "dist/index.js",
     "repository": "https://github.com/contentstack/app-sdk",
     "scripts": {
-        "prepublish": "npm run build",
+            "postpack": "ggshield secret scan archive ./*.tgz",
+    "prepublish": "npm run build",
         "build": "webpack",
         "test": "jest",
         "test:watch": "jest --watchAll",