Repository navigation
Add report index #974
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret scanning | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| # sha256 of gitleaks_8.30.1_linux_x64.tar.gz, from the release's checksums file. | |
| GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: { fetch-depth: 0 } | |
| # The gitleaks-action wrapper needs a license for organization repos. This | |
| # runs the open-source CLI directly and scans the same commit range the | |
| # wrapper did: the commits a PR adds, or the commits a push adds. | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -sSfL -o "$RUNNER_TEMP/$archive" \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}" | |
| echo "${GITLEAKS_SHA256} $RUNNER_TEMP/$archive" | sha256sum -c - | |
| tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" gitleaks | |
| "$RUNNER_TEMP/gitleaks" version | |
| - name: Scan commits | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BEFORE: ${{ github.event.before }} | |
| PUSH_AFTER: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| range="${PR_BASE_SHA}..${PR_HEAD_SHA}" | |
| elif [ -n "$PUSH_BEFORE" ] && ! [[ "$PUSH_BEFORE" =~ ^0+$ ]] \ | |
| && git cat-file -e "${PUSH_BEFORE}^{commit}" 2>/dev/null; then | |
| range="${PUSH_BEFORE}..${PUSH_AFTER}" | |
| else | |
| # New branch or a before-commit this clone cannot see: scan the tip only. | |
| range="-1" | |
| fi | |
| echo "gitleaks log range: $range" | |
| if [ "$range" = "-1" ]; then | |
| log_opts="-1" | |
| else | |
| log_opts="--no-merges --first-parent $range" | |
| fi | |
| "$RUNNER_TEMP/gitleaks" git --redact -v --no-banner --exit-code 2 \ | |
| --log-opts="$log_opts" . |