Add detect secrets

.borg.toml

@@ -5,7 +5,9 @@ files_url = "https://raw.githubusercontent.com/techservicesillinois/splunk-soar-
 files = [
 		# secdev-template-repository is authoritative for these
 		".github/workflows/cleanup.yml",
+		".github/workflows/detect-secrets.yml",
 		".github/workflows/pr_reminder.yml",
+		'.pre-commit-config.yaml',
 		'CODE_OF_CONDUCT.md',
 		'SECURITY.md',
 		# splunk-soar-template is authoritative for these

.secrets.baseline

@@ -126,27 +126,6 @@
       "path": "detect_secrets.filters.heuristic.is_templated_secret"
     }
   ],
-  "results": {
-    "CONTRIBUTING.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "CONTRIBUTING.md",
-        "hashed_secret": "088563a7442bb300a250c95dddf1d5c3d3a54b6c",
-        "is_verified": false,
-        "line_number": 52,
-        "is_secret": false
-      }
-    ],
-    "tests/conftest.py": [
-      {
-        "type": "Secret Keyword",
-        "filename": "tests/conftest.py",
-        "hashed_secret": "088563a7442bb300a250c95dddf1d5c3d3a54b6c",
-        "is_verified": false,
-        "line_number": 14,
-        "is_secret": false
-      }
-    ]
-  },
-  "generated_at": "2026-06-22T20:42:32Z"
+  "results": {},
+  "generated_at": "2026-05-21T19:54:49Z"
 }

CONTRIBUTING.md

@@ -4,12 +4,12 @@ This document aims to outline the requirements for the various forms of contribu
 
 All contributions are subject to review via pull request.
 
-## Working from the template repository.
+## Working from the template repository
 
 > Remove this section from this document once these steps are completed.
 
 - Replace all instances of APP_NAME in files
-- Review the [application metadata][14] (app.json) 
+- Review the [application metadata][14] (app.json)
   - add/remove configuration settings
   - add/remove actions
 - add `SOAR_HOSTNAME` and `SOAR_TOKEN` to GitHub secrets for deployment
@@ -20,7 +20,7 @@ All contributions are subject to review via pull request.
 
 ## Development Setup
 
-### Setup PyEnv 
+### Setup PyEnv
 
 1. [Install PyEnv](https://github.com/pyenv/pyenv#basic-github-checkout)
 
@@ -47,16 +47,17 @@ make test
 ## To record a new test cassette
 
 Export the following variables
+
 ```sh
 export APP_USERNAME="FAKE_USERNAME"
-export APP_PASSWORD="FAKE_PASSWORD"
+export APP_PASSWORD="FAKE_PASSWORD" # pragma: allowlist secret
 export APP_ENDPOINT="cybersecurity.illinois.edu/robots.txt"
 export VCR_RECORD=1
 ```
 
 ## Deployment
 
-In GitHub, under 
+In GitHub, under
 `Secrets` then `Actions` add the following `Repository Secrets`:
 
 `SOAR_HOSTNAME` set to `automate-illinois.soar.splunkcloud.com`
@@ -66,9 +67,11 @@ In GitHub, under
 
 To emit a log into the SOAR debug logs, use `self.debug_print`:
 
-    `self.debug_print("git_hash", __git_hash__)`
+```python
+self.debug_print("git_hash", __git_hash__)`
+```
 
-To read SOAR app DEBUG logs, visit SOAR `Administration` in the main drop-down, and look under `System Health` and then `Debugging`. 
+To read SOAR app DEBUG logs, visit SOAR `Administration` in the main drop-down, and look under `System Health` and then `Debugging`.
 
 > Tip: You must have specific permissions assigned to your account to access this area.
 
@@ -78,3 +81,16 @@ SOAR logs are in the phantom folders, nested pretty deep.
 Deployment logs are in `app_install`.
 
 > For SOAR app logs, you may need to check multiple files, based on which broker your code ran on.
+
+## Regenerating .gitattributes
+
+Because this is a template repository, running `make .gitattributes` may fail due to any local changes to `.borg.toml` - because the changes have not yet been merged to `main` in this repository / in the authoritative template.
+
+The work-around for this is to use `--source-dir` to point `borg` at the current working directory `.`, when calling `borg` to regenerate `.gitattirbutes`.
+
+This command will work to regenerated `.gitattributes` even if the `.borg.toml` in the current branch has changed and not been merged into `main`, yet.
+
+```sh
+borg -s . gen .gitattributes
+```
+

tests/conftest.py

@@ -11,7 +11,7 @@
 pytest_plugins = ("splunk-soar-connectors")
 
 CASSETTE_USERNAME = "FAKE_USERNAME"
-CASSETTE_PASSWORD = "FAKE_PASSWORD"
+CASSETTE_PASSWORD = "FAKE_PASSWORD"  # pragma: allowlist secret
 CASSETTE_ENDPOINT = "cybersecurity.illinois.edu/robots.txt"
 
 # To record, `export VCR_RECORD=True`