`migrate-secret-alerts` does not take into account secrets of the generic kind
- Dominant language
- C#
- Stars
- 478
- Forks
- 146
- Avg merge
- 7d 21h
- Merged PRs (30d)
- 2
Description
## Description
The repository that I am migrating has a test RSA private key committed somewhere in its history.
When migrating this repo to a GHE.com instance the alert is left open although it's closed in the origin repository (being a test key).
## Desired outcome
The alert is closed in the destination repository
## Log output
```
[2026-07-28 17:18:07] [DEBUG] HTTP GET: https://api.github.com/repos/redactedw-redactedv/iedereen.app/secret-scanning/alerts?per_page=100
[2026-07-28 17:18:08] [DEBUG] GITHUB REQUEST ID: E4D0:213DFA:DDA922:D1BF98:6A68C82F
[2026-07-28 17:18:08] [DEBUG] RESPONSE (OK): []
[2026-07-28 17:18:08] [DEBUG] HTTP GET: https://api.redactedvo.ghe.com/repos/redactedw-in-redactedv/iedereen.app/secret-scanning/alerts?per_page=100
[2026-07-28 17:18:08] [DEBUG] GITHUB REQUEST ID: 266C:22BD11:D9C9:30683:6A68C830
[2026-07-28 17:18:08] [DEBUG] RESPONSE (OK): []
[2026-07-28 17:18:08] [INFO] Source redactedw-redactedv/iedereen.app secret alerts found: 0
[2026-07-28 17:18:08] [INFO] Target redactedw-in-redactedv/iedereen.app secret alerts found: 0
```
## Code
https://github.com/github/gh-gei/blob/230bba8a65f5cc6b9ccb3ae1ad76d773c1f9412d/src/Octoshift/Services/GithubApi.cs#L956
This API call will only return the default alerts as per https://docs.github.com/en/rest/secret-scanning/secret-scanning?apiVersion=2026-03-10#list-secret-scanning-alerts-for-a-repository .
Adding `?secret_type=rsa_private_key` returns the aforementioned secret.
Not sure how to fix this given the API surface, building the `secret_type` querystring value based on all the known generic types at https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns looks a bit brittle
But brittle is what I went for in https://github.com/github/gh-gei/pull/1596 to get me back up and running
Contributor guide
Research direction
Start at src/Octoshift/Services/GithubApi.cs around line 956 and review the linked API documentation for the secret_type query parameter and generic patterns. Compare the behavior with pull request 1596; done means generic secret alerts such as rsa_private_key are included so the destination alert is closed when the source alert is closed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, github
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100