Workflows
Review & Secret Scanning
Review changed code for environment drift and hard-coded secrets before a pull request is merged, with redacted human and machine-readable output.
What review checks
ghostable review combines two local checks:
- ENV state drift finds environment references added in changed code and compares them with encrypted values, schema files,
.env.example, and signed Ghostable records. - Hard-coded secret scanning looks for likely credentials in changed files and redacts matching values by default.
ENV reference detection covers common patterns in PHP/Laravel, JavaScript/TypeScript/Node, Go, Python, Ruby/Rails, Java, C#, Rust, Swift, and shell or deployment scripts. GitHub Actions environment references under .github/ are ignored because they often refer to GitHub Secrets or Variables.
Git comparison
Without --base, Ghostable tries the current branch upstream, then origin/main, origin/master, main, master, and finally HEAD. The head includes local worktree changes by default.
$ ghostable review --base origin/main --head HEAD
$ ghostable review app/ config/ --base origin/main
Focused review modes
$ ghostable review --env-only
$ ghostable review --secrets-only
$ ghostable scan
scan remains a compatibility command for the hard-coded secret scanner. Prefer review --secrets-only in new scripts.
Scan configuration
The project manifest sets the default scan level to standard and ignores Git metadata, dependencies, build output, encrypted value files, and environment key files. Override a run with --level relaxed|standard|strict, repeated --ignore patterns, or --max-size.
Output formats
$ ghostable review --format github
$ ghostable review --json
$ ghostable review --secrets-only --json
Use GitHub format for annotations in Actions and JSON for other automation.
Suppressions
Create a signed, scoped, optionally expiring suppression only after reviewing a false positive:
$ ghostable review suppress --code <finding-code> --path tests/Fixtures/token.php --line 14 --reason "Documented test fixture" --expires-in 30d
Suppression records are repository-visible policy decisions. Prefer narrow path, line, kind, key, and expiration scopes over broad permanent exclusions.