Skip to content

fix(ci): support macOS gitleaks runners #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adoosh-afk merged 1 commit into from
Jul 28, 2026
Merged

fix(ci): support macOS gitleaks runners #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions .github/workflows/shared-secrets-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,9 @@ name: Shared secrets scan
# sibling adoption PR can succeed.
#
# Behaviour:
# - arch-detect (arm64|x64); UNSUPPORTED ARCH => error + exit 1 (fail-closed).
# - download the pinned gitleaks release for the detected arch.
# - platform/arch-detect (linux|darwin × arm64|x64); unsupported pairs error
# and exit 1 (fail-closed).
# - download the pinned gitleaks release for the detected platform and arch.
# - `gitleaks detect` over the requested source-path + log-opts.
# This workflow is NEVER gated on docs-only: a markdown PR pasting a real
# credential is exactly the threat model it exists for (Modelsmith #1041).
Expand Down Expand Up @@ -83,20 +84,25 @@ jobs:
clean: true
fetch-depth: 0

- name: Install gitleaks (arch-aware, pinned)
- name: Install gitleaks (platform- and arch-aware, pinned)
env:
GITLEAKS_VERSION: ${{ inputs.gitleaks-version }}
run: |
set -euo pipefail
echo "Installing gitleaks v${GITLEAKS_VERSION}"
case "$(uname -s)" in
Linux) GITLEAKS_OS=linux ;;
Darwin) GITLEAKS_OS=darwin ;;
*) echo "::error::Unsupported OS $(uname -s) for gitleaks install"; exit 1 ;;
esac
case "$(uname -m)" in
aarch64|arm64) GITLEAKS_ARCH=arm64 ;;
x86_64) GITLEAKS_ARCH=x64 ;;
*) echo "::error::Unsupported arch $(uname -m) for gitleaks install"; exit 1 ;;
esac
GITLEAKS_BIN_DIR="${RUNNER_TEMP}/gitleaks-bin"
mkdir -p "$GITLEAKS_BIN_DIR"
curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${GITLEAKS_ARCH}.tar.gz" \
curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${GITLEAKS_OS}_${GITLEAKS_ARCH}.tar.gz" \
| tar -xz -C "$GITLEAKS_BIN_DIR" gitleaks
echo "$GITLEAKS_BIN_DIR" >> "$GITHUB_PATH"

Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ It is deliberately **public** so that public org repos (e.g. [`assay-harness`](h

### `shared-secrets-scan.yml` — gitleaks secrets scan

Arch-aware, version-pinned `gitleaks detect`. The single source of truth for the org secrets-scan gate; runs with `permissions: contents: read` only (no secrets, fork-PR safe).
Platform- and arch-aware, version-pinned `gitleaks detect` (Linux or macOS on arm64 or x64). The single source of truth for the org secrets-scan gate; runs with `permissions: contents: read` only (no secrets, fork-PR safe).

Consume it with a **40-char commit SHA pin** (never a branch or mutable tag):

Expand Down
Loading