Description
The repository that I am migrating has a test RSA private key committed somewhere in its history.
When migrating this repo to a GHE.com instance the alert is left open although it's closed in the origin repository (being a test key).
Desired outcome
The alert is closed in the destination repository
Log output
[2026-07-28 17:18:07] [DEBUG] HTTP GET: https://api.github.com/repos/redactedw-redactedv/iedereen.app/secret-scanning/alerts?per_page=100
[2026-07-28 17:18:08] [DEBUG] GITHUB REQUEST ID: E4D0:213DFA:DDA922:D1BF98:6A68C82F
[2026-07-28 17:18:08] [DEBUG] RESPONSE (OK): []
[2026-07-28 17:18:08] [DEBUG] HTTP GET: https://api.redactedvo.ghe.com/repos/redactedw-in-redactedv/iedereen.app/secret-scanning/alerts?per_page=100
[2026-07-28 17:18:08] [DEBUG] GITHUB REQUEST ID: 266C:22BD11:D9C9:30683:6A68C830
[2026-07-28 17:18:08] [DEBUG] RESPONSE (OK): []
[2026-07-28 17:18:08] [INFO] Source redactedw-redactedv/iedereen.app secret alerts found: 0
[2026-07-28 17:18:08] [INFO] Target redactedw-in-redactedv/iedereen.app secret alerts found: 0
Code
|
var url = $"{_apiUrl}/repos/{org.EscapeDataString()}/{repo.EscapeDataString()}/secret-scanning/alerts?per_page=100"; |
This API call will only return the default alerts as per https://docs.github.com/en/rest/secret-scanning/secret-scanning?apiVersion=2026-03-10#list-secret-scanning-alerts-for-a-repository .
Adding ?secret_type=rsa_private_key returns the aforementioned secret.
Not sure how to fix this given the API surface, building the secret_type querystring value based on all the known generic types at https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns looks a bit brittle
But brittle is what I went for in #1596 to get me back up and running
Description
The repository that I am migrating has a test RSA private key committed somewhere in its history.
When migrating this repo to a GHE.com instance the alert is left open although it's closed in the origin repository (being a test key).
Desired outcome
The alert is closed in the destination repository
Log output
Code
gh-gei/src/Octoshift/Services/GithubApi.cs
Line 956 in 230bba8
This API call will only return the default alerts as per https://docs.github.com/en/rest/secret-scanning/secret-scanning?apiVersion=2026-03-10#list-secret-scanning-alerts-for-a-repository .
Adding
?secret_type=rsa_private_keyreturns the aforementioned secret.Not sure how to fix this given the API surface, building the
secret_typequerystring value based on all the known generic types at https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns looks a bit brittleBut brittle is what I went for in #1596 to get me back up and running