GitHub MCP Server で secret scanning を組み込む AIコーディング時代の流出対策

hooks:
  pre-tool-use:
    matchers:
      - tool: github.create_or_update_file
      - tool: github.push_files
    handler: scan-payload-for-secrets.sh
    on_match: block

GitHub secret scanning アラート発火
        ↓
GitHub Actions ワークフロー起動（repository_dispatch / webhook）
        ↓
① Slack / GitHub Issue で所有者・セキュリティチームへ通知
        ↓
② 旧 credential を無効化（プロバイダ API）
        ↓
③ 新 credential 生成 → GitHub Secrets / Vault に再登録
        ↓
④ 監査ログへ記録（append-only）

# .github/workflows/secret-rotate.yml
name: Secret Rotate on Leak Detection

on:
  secret_scanning_alert:
    types: [created]

permissions:
  issues: write
  contents: read

jobs:
  notify-and-rotate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Notify Slack
        uses: slackapi/slack-github-action@v2
        with:
          payload: |
            {
              "text": ":rotating_light: *Secret leak detected*\nRepo: ${{ github.repository }}\nSecret type: ${{ github.event.alert.secret_type }}\nAlert URL: ${{ github.event.alert.html_url }}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Open GitHub Issue
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `[SECURITY] Secret leak: ${{ github.event.alert.secret_type }}`,
              body: [
                '## Secret Leak Detected',
                '',
                `- **Type**: \`${{ github.event.alert.secret_type }}\``,
                `- **Alert**: ${{ github.event.alert.html_url }}`,
                `- **Detected at**: ${new Date().toISOString()}`,
                '',
                '## Action Required',
                '- [ ] Confirm credential has been rotated',
                '- [ ] Remove secret from git history (git filter-repo / BFG)',
                '- [ ] Audit access logs for unauthorized use',
              ].join('\n'),
              labels: ['security', 'secret-leak'],
            });

#!/usr/bin/env bash
# scripts/rotate-github-pat.sh
# Usage: GITHUB_TOKEN=<admin_pat> ./rotate-github-pat.sh <org> <secret_name>
set -euo pipefail

ORG="${1:?Usage: $0 <org> <secret_name>}"
SECRET_NAME="${2:?}"

echo "[1/3] Generating new PAT via GitHub App token exchange..."
# 実プロジェクトでは GitHub App の installation token を使うのが推奨
NEW_TOKEN=$(gh auth token)   # ← 実装時はアプリ認証に差し替える

echo "[2/3] Updating Organization Secret: ${SECRET_NAME}"
gh secret set "${SECRET_NAME}" \
  --org "${ORG}" \
  --body "${NEW_TOKEN}" \
  --visibility all

echo "[3/3] Logging rotation event..."
jq -n \
  --arg secret "${SECRET_NAME}" \
  --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  '{"event":"secret_rotated","secret":$secret,"rotated_at":$ts}' \
  >> audit/secret-rotation.log

echo "Done. Notify the team to update any local references to ${SECRET_NAME}."

# .github/workflows/rotate-api-key.yml
name: Rotate API Key

on:
  workflow_dispatch:
    inputs:
      provider:
        description: "Provider (stripe / openai / sendgrid)"
        required: true
        type: choice
        options: [stripe, openai, sendgrid]
      secret_name:
        description: "GitHub Secret name to update"
        required: true

jobs:
  rotate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Rotate Stripe key
        if: inputs.provider == 'stripe'
        run: |
          # Stripe: 旧キー失効 → 新キー生成
          OLD_KEY="${{ secrets.STRIPE_SECRET_KEY }}"
          NEW_KEY=$(curl -s -X POST https://api.stripe.com/v1/restricted_keys \
            -u "${OLD_KEY}:" \
            -d "name=rotated-$(date +%Y%m%d)" \
            | jq -r '.secret')
          gh secret set "${{ inputs.secret_name }}" --body "${NEW_KEY}"
          # 旧キー失効（Stripe Dashboard または API）
          echo "Rotated Stripe key. Revoke old key manually in Dashboard."

      - name: Rotate OpenAI key
        if: inputs.provider == 'openai'
        run: |
          # OpenAI: Admin API でキー削除 → 再生成
          curl -s -X DELETE "https://api.openai.com/v1/organization/api_keys/${{ secrets.OPENAI_KEY_ID }}" \
            -H "Authorization: Bearer ${{ secrets.OPENAI_ADMIN_KEY }}"
          NEW_KEY=$(curl -s -X POST "https://api.openai.com/v1/organization/api_keys" \
            -H "Authorization: Bearer ${{ secrets.OPENAI_ADMIN_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"name":"rotated-auto"}' \
            | jq -r '.value')
          gh secret set "${{ inputs.secret_name }}" --body "${NEW_KEY}"

# BFG Repo Cleaner を使う場合（推奨：高速）
java -jar bfg.jar --replace-text secrets-to-remove.txt .git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force-with-lease

# git filter-repo を使う場合（Python製、よりきめ細かい制御が可能）
pip install git-filter-repo
git filter-repo --replace-text <(echo "OLD_SECRET_VALUE==>REMOVED")