github / github/gh-gei

`migrate-secret-alerts` does not take into account secrets of the generic kind

Open
#1,595 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
C#
Stars
478
Forks
146
Avg merge
7d 21h
Merged PRs (30d)
2

Description

## Description

The repository that I am migrating has a test RSA private key committed somewhere in its history.

When migrating this repo to a GHE.com instance the alert is left open although it's closed in the origin repository (being a test key).

## Desired outcome

The alert is closed in the destination repository

## Log output

```
[2026-07-28 17:18:07] [DEBUG] HTTP GET: https://api.github.com/repos/redactedw-redactedv/iedereen.app/secret-scanning/alerts?per_page=100
[2026-07-28 17:18:08] [DEBUG] GITHUB REQUEST ID: E4D0:213DFA:DDA922:D1BF98:6A68C82F
[2026-07-28 17:18:08] [DEBUG] RESPONSE (OK): []
[2026-07-28 17:18:08] [DEBUG] HTTP GET: https://api.redactedvo.ghe.com/repos/redactedw-in-redactedv/iedereen.app/secret-scanning/alerts?per_page=100
[2026-07-28 17:18:08] [DEBUG] GITHUB REQUEST ID: 266C:22BD11:D9C9:30683:6A68C830
[2026-07-28 17:18:08] [DEBUG] RESPONSE (OK): []
[2026-07-28 17:18:08] [INFO] Source redactedw-redactedv/iedereen.app secret alerts found: 0
[2026-07-28 17:18:08] [INFO] Target redactedw-in-redactedv/iedereen.app secret alerts found: 0
```

## Code

https://github.com/github/gh-gei/blob/230bba8a65f5cc6b9ccb3ae1ad76d773c1f9412d/src/Octoshift/Services/GithubApi.cs#L956

This API call will only return the default alerts as per https://docs.github.com/en/rest/secret-scanning/secret-scanning?apiVersion=2026-03-10#list-secret-scanning-alerts-for-a-repository .

Adding `?secret_type=rsa_private_key` returns the aforementioned secret.

Not sure how to fix this given the API surface, building the `secret_type` querystring value based on all the known generic types at https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns looks a bit brittle

But brittle is what I went for in https://github.com/github/gh-gei/pull/1596 to get me back up and running

Contributor guide

Open the contributing guide

Research direction

Start at src/Octoshift/Services/GithubApi.cs around line 956 and review the linked API documentation for the secret_type query parameter and generic patterns. Compare the behavior with pull request 1596; done means generic secret alerts such as rsa_private_key are included so the destination alert is closed when the source alert is closed.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, github
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.