PLT-639: Adding gitleaks MBI scanning & updating gitleaks pre-commit …

…version (#185)

## 🎫 Ticket

https://jira.cms.gov/browse/PLT-639

## 🛠 Changes

Gitleaks custom config extension was added (.gitleaks.toml) allowing for
a regex-based MBI filter to be run against new commits, and the gitleaks
pre-commit version was updated to 8.19.x which doesn't affect us at this
time.

## ℹ️ Context

Bulk API Platform Team has an ongoing goal of improving security and
safeguarding PHI/PII for our members, to that end we are applying a
belt-and-suspenders approach to preventing leakage of data (such as
Medicare Beneficiary Identifiers) in github.

##   Validation

These changes were tested locally and automatically as they make
modifications to the pre-commit functionality, and were initially tested
and validated against a pregenerated file with MBI data in PLT-532.

.github/workflows/ci-workflow.yml

@@ -32,7 +32,7 @@ jobs:
         run: |
           make test
       - name: Archive code coverage results
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: code-coverage-report
           path: ./test_results/latest/testcoverage.out
@@ -46,7 +46,7 @@ jobs:
       ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: "true"
     steps:
       - name: Download code coverage
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: code-coverage-report
       - name: Set env vars from AWS params

.gitleaks.toml

@@ -0,0 +1,9 @@
+title = "DASG Standard"
+
+[extend]
+  useDefault = true
+
+[[rules]]
+  id = "mbi-detection"
+  description = "Detects a potential MBI pattern based on https://www.cms.gov/medicare/new-medicare-card/understanding-the-mbi.pdf"
+  regex = '''\b((?i)[1-9][ACDEFGHJKMNPQRTUVWXY][ACDEFGHJKMNPQRTUVWXY\d]-?\d[ACDEFGHJKMNPQRTUVWXY][ACDEFGHJKMNPQRTUVWXY\d]\d-?[ACDEFGHJKMNPQRTUVWXY]{2}\d{2})\b'''

.pre-commit-config.yaml

@@ -1,10 +1,10 @@
 repos:
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.16.1
+    rev: v8.19.2
     hooks:
       - id: gitleaks
   - repo: https://github.com/tekwizely/pre-commit-golang
-    rev: master
+    rev: v1.0.0-rc.1
     hooks:
       - id: go-imports
         args: ['-w']