Update secret-scanning pipeline (#52146)

.github/workflows/test.yml

@@ -71,6 +71,7 @@ jobs:
           - release-notes
           - rest
           - search
+          - secret-scanning
           - shielding
           - tracking
           # - tests

src/secret-scanning/README.md

@@ -1,3 +1,18 @@
 # Secret scanning
 
-The files in the secret scanning folder support our secret scanning informational pages.
+This secret scanning pipeline automates a table displayed on the [Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets) page.
+
+Each day a workflow checks if the [data](src/secret-scanning/data/public-docs.yml) is up-to-date. When there are changes, the workflow automatically creates a pull request to update the `src/secret-scanning/data/public-docs.yml` file. The workflow runs `npm run sync-secret-scanning` to check for updates.
+
+This pipeline uses middleware to check if the path of the URL matches the page that contains the table. The middleware decorates the context with the data, which is displayed on the page using a Markdown table and Liquid. For example:
+
+```markdown
+<!-- FPT version of table -->
+{% ifversion fpt %}
+
+| Provider | Token | Partner | User | Push protection
+|----|:----|:----:|:----:|:----:|
+{%- for entry in secretScanningData %}
+| {{ entry.provider }} | {{ entry.secretType }} | {% if entry.isPublic %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Unsupported" %}{% endif %} | {% if entry.isPrivateWithGhas %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Unsupported" %}{% endif %} | {% if entry.hasPushProtection %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Unsupported" %}{% endif %} |
+{%- endfor %}
+```

src/secret-scanning/lib/config.json

@@ -1,4 +1,5 @@
 {
   "sha": "bb86a15b48fe62030cf0ad8c38520508063ec20b",
-  "blob-sha": "96de8d829b93d371162f193a68ea19ae86ac0d09"
+  "blob-sha": "96de8d829b93d371162f193a68ea19ae86ac0d09",
+  "targetFilename": "code-security/secret-scanning/introduction/supported-secret-scanning-patterns"
 }

src/secret-scanning/middleware/secret-scanning.ts

@@ -9,17 +9,19 @@ import { ExtendedRequest, SecretScanningData } from '@/types'
 
 const secretScanningPath = 'src/secret-scanning/data/public-docs.yml'
 
+// This is the path to the file that contains the secret scanning data.
+// Currently it's:
+// code-security/secret-scanning/introduction/supported-secret-scanning-pattern
+const { targetFilename } = JSON.parse(
+  fs.readFileSync('src/secret-scanning/lib/config.json', 'utf-8'),
+)
+
 export default async function secretScanning(
   req: ExtendedRequest,
   res: Response,
   next: NextFunction,
 ) {
-  if (
-    !req.pagePath!.endsWith(
-      'code-security/secret-scanning/introduction/supported-secret-scanning-patterns',
-    )
-  )
-    return next()
+  if (!req.pagePath!.endsWith(targetFilename)) return next()
 
   const secretScanningData = yaml.load(
     fs.readFileSync(secretScanningPath, 'utf-8'),

src/secret-scanning/tests/rendering.js

@@ -0,0 +1,14 @@
+import { describe, expect, test } from 'vitest'
+import { readFileSync } from 'fs'
+
+import { get } from '#src/tests/helpers/e2etest.js'
+
+describe('secret-scanning pipeline', () => {
+  const { targetFilename } = JSON.parse(readFileSync('src/secret-scanning/lib/config.json'))
+  // This test ensures that the configured page exists. If the page moves
+  // this test will fail.
+  test(`check if ${targetFilename} was moved`, async () => {
+    const page = await get(`/${targetFilename}`, { followRedirects: true })
+    expect(page.statusCode).toBe(200)
+  })
+})