ajeetraina777/gitguardian-kit:copilot

schemaVersion: "2"
kind: mixin
name: gitguardian-copilot
displayName: GitGuardian (ggshield) — Copilot CLI
description: Installs the GitGuardian CLI (ggshield) with proxy-injected API-key auth for api.gitguardian.com and wires it as a Copilot CLI AI hook, so the agent's own actions are scanned for hardcoded secrets automatically - the real key never enters the sandbox.
agentInstructions:
    content: |
        ## GitGuardian secret scanning (ggshield)

        `ggshield` is installed and authenticated against `api.gitguardian.com`
        through the sandbox proxy - `GITGUARDIAN_API_KEY` is a proxy-managed
        placeholder inside the container, never the real key.

        ### Automatic enforcement (Copilot CLI hook)

        `ggshield` is installed as a Copilot CLI AI hook (`~/.copilot/hooks/hooks.json`), so your
        own actions are scanned for secrets automatically - you do not need to
        remember to scan manually. If the hook BLOCKS an action, a real secret was
        detected. Do NOT retry or try to bypass it. Instead: locate the flagged
        secret, remove it from the code, and tell the user it must be rotated. Only
        proceed once the secret is gone.

        ### Manual scans

        Use these to catch hardcoded secrets on demand:

        - `ggshield secret scan path -r .` - recursively scan the workspace files.
        - `ggshield secret scan repo .` - scan full git history + working tree
          (catches secrets that were committed and later removed).
        - `ggshield secret scan ci` - scan the current commit range in CI.
        - `ggshield api-status` / `ggshield quota` - verify auth and remaining quota.

        Run a scan after generating or editing code that might contain credentials,
        and before any `git commit`. If a real secret is found, remove it and rotate
        it - do not commit it. For the EU workspace or a self-hosted instance, the
        operator must set `GITGUARDIAN_INSTANCE` and add that host to the kit's
        network allowlist and credential inject block.
permissions:
    network:
        allow:
            - github.com
            - objects.githubusercontent.com
            - release-assets.githubusercontent.com
            - api.gitguardian.com
credentials:
    - service: gitguardian
      description: GitGuardian API key (from a Personal or Service Account, "scan" scope). Stored on the host; the sandbox only sees a placeholder and the proxy injects the real value on requests to api.gitguardian.com.
      required: true
      apiKey:
        name: GITGUARDIAN_API_KEY
        inject:
            - domain: api.gitguardian.com
              header: Authorization
              format: Token %s
environment:
    variables:
        GITGUARDIAN_API_KEY: proxy-managed
setup:
    install:
        - command: |
            set -euo pipefail
            GGSHIELD_VERSION=1.53.0
            ARCH=$(dpkg --print-architecture)
            case "$ARCH" in
              amd64)
                SLUG="x86_64-unknown-linux-gnu"
                SHA256="234d1a62ea7b769695c7e5aee8f29e9d0069cd09b4e5b67493d3b529abb44e4a"
                ;;
              arm64)
                SLUG="aarch64-unknown-linux-gnu"
                SHA256="097616513fe7a4f25831a464b8968b124af32d274e2ce006e388800605696b20"
                ;;
              *)
                echo "unsupported sandbox arch: $ARCH (expected amd64 or arm64)" >&2
                exit 1
                ;;
            esac
            DIRNAME="ggshield-${GGSHIELD_VERSION}-${SLUG}"
            TARBALL="${DIRNAME}.tar.gz"
            URL="https://github.com/GitGuardian/ggshield/releases/download/v${GGSHIELD_VERSION}/${TARBALL}"
            curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/ggshield.tgz "$URL"
            echo "${SHA256}  /tmp/ggshield.tgz" | sha256sum -c -
            rm -rf /opt/ggshield
            tar -C /opt -xzf /tmp/ggshield.tgz
            mv "/opt/${DIRNAME}" /opt/ggshield
            ln -sf /opt/ggshield/ggshield /usr/local/bin/ggshield
            rm -f /tmp/ggshield.tgz
            ggshield --version
          user: "0"
          description: Install ggshield v1.53.0, version+digest pinned
        - command: |
            set -euo pipefail
            ggshield machine setup --agent copilot --no-git-hooks --no-honeytokens
            echo "ggshield AI hook installed (~/.copilot/hooks/hooks.json)"
          user: "1000"
          description: Install ggshield as a Copilot CLI AI hook (agent user)