From 59712bdfc214481bf48b9d039b5dfc4cdd895836 Mon Sep 17 00:00:00 2001 From: "Hel.isa R" <17197528+hel-isa@users.noreply.github.com> Date: Fri, 27 Mar 2026 20:47:40 -0400 Subject: [PATCH 1/2] Update Gitleaks configuration handling in workflow --- .github/workflows/reusable-secrets.yml | 98 +++++++++++++------------- 1 file changed, 49 insertions(+), 49 deletions(-) diff --git a/.github/workflows/reusable-secrets.yml b/.github/workflows/reusable-secrets.yml index 7e67863..093b22c 100644 --- a/.github/workflows/reusable-secrets.yml +++ b/.github/workflows/reusable-secrets.yml @@ -20,6 +20,7 @@ permissions: jobs: secrets: runs-on: ubuntu-latest + steps: - name: Checkout repository uses: actions/checkout@v4 @@ -40,59 +41,58 @@ jobs: if [ ! -f "$CONFIG_PATH" ]; then echo "Config file not found at $CONFIG_PATH. Creating a default Gitleaks config." - mkdir -p "$(dirname "$CONFIG_PATH")" cat > "$CONFIG_PATH" <<'EOF' - title = "Default Gitleaks Config" - - [extend] - useDefault = true - - [allowlist] - description = "Global allowlist" - paths = [ - '''(^|/)node_modules(/|$)''', - '''(^|/)dist(/|$)''', - '''(^|/)build(/|$)''', - '''(^|/)\.git(/|$)''', - '''(^|/)reports(/|$)''' - ] - EOF - else - echo "Using existing Gitleaks config at $CONFIG_PATH" - fi - - - name: Run Gitleaks - id: gitleaks - run: | - set -euo pipefail - mkdir -p reports - - set +e - gitleaks detect \ - --source . \ - --report-format json \ - --report-path reports/gitleaks-report.json \ - --config "${{ inputs.config_path }}" - EXIT_CODE=$? - set -e - - if [ ! -f reports/gitleaks-report.json ]; then - echo '[]' > reports/gitleaks-report.json - fi - - FINDINGS_COUNT=$(python - <<'PY' - import json - from pathlib import Path + title = "Default Gitleaks Config" + + [extend] + useDefault = true + + [allowlist] + description = "Global allowlist" + paths = [ + '''(^|/)node_modules(/|$)''', + '''(^|/)dist(/|$)''', + '''(^|/)build(/|$)''', + '''(^|/)\.git(/|$)''', + '''(^|/)reports(/|$)''' + ] + EOF + else + echo "Using existing Gitleaks config at $CONFIG_PATH" + fi + + - name: Run Gitleaks + id: gitleaks + run: | + set -euo pipefail + mkdir -p reports + + set +e + gitleaks detect \ + --source . \ + --report-format json \ + --report-path reports/gitleaks-report.json \ + --config "${{ inputs.config_path }}" + EXIT_CODE=$? + set -e + + if [ ! -f reports/gitleaks-report.json ]; then + echo '[]' > reports/gitleaks-report.json + fi + + FINDINGS_COUNT=$(python - <<'PY' + import json + from pathlib import Path - path = Path("reports/gitleaks-report.json") - try: - data = json.loads(path.read_text()) - print(len(data) if isinstance(data, list) else 0) - except Exception: - print(0) - PY + path = Path("reports/gitleaks-report.json") + try: + data = json.loads(path.read_text()) + print(len(data) if isinstance(data, list) else 0) + except Exception: + print(0) + PY ) echo "findings_count=${FINDINGS_COUNT}" >> "$GITHUB_OUTPUT" From 560d16ddbbf6ad174389ae2d2f3a1f6382ec0534 Mon Sep 17 00:00:00 2001 From: "Hel.isa R" <17197528+hel-isa@users.noreply.github.com> Date: Fri, 27 Mar 2026 20:57:57 -0400 Subject: [PATCH 2/2] Refactor Gitleaks config creation and findings count --- .github/workflows/reusable-secrets.yml | 66 +++++++++++--------------- 1 file changed, 27 insertions(+), 39 deletions(-) diff --git a/.github/workflows/reusable-secrets.yml b/.github/workflows/reusable-secrets.yml index 093b22c..3e9b8a1 100644 --- a/.github/workflows/reusable-secrets.yml +++ b/.github/workflows/reusable-secrets.yml @@ -43,22 +43,21 @@ jobs: echo "Config file not found at $CONFIG_PATH. Creating a default Gitleaks config." mkdir -p "$(dirname "$CONFIG_PATH")" - cat > "$CONFIG_PATH" <<'EOF' - title = "Default Gitleaks Config" - - [extend] - useDefault = true - - [allowlist] - description = "Global allowlist" - paths = [ - '''(^|/)node_modules(/|$)''', - '''(^|/)dist(/|$)''', - '''(^|/)build(/|$)''', - '''(^|/)\.git(/|$)''', - '''(^|/)reports(/|$)''' - ] - EOF + printf "%s\n" \ + "title = \"Default Gitleaks Config\"" \ + "" \ + "[extend]" \ + "useDefault = true" \ + "" \ + "[allowlist]" \ + "description = \"Global allowlist\"" \ + "paths = [" \ + " '''(^|/)node_modules(/|$)'''," \ + " '''(^|/)dist(/|$)'''," \ + " '''(^|/)build(/|$)'''," \ + " '''(^|/)\\.git(/|$)'''," \ + " '''(^|/)reports(/|$)'''" \ + "]" > "$CONFIG_PATH" else echo "Using existing Gitleaks config at $CONFIG_PATH" fi @@ -82,30 +81,19 @@ jobs: echo '[]' > reports/gitleaks-report.json fi - FINDINGS_COUNT=$(python - <<'PY' - import json - from pathlib import Path + FINDINGS_COUNT=$(jq 'if type=="array" then length else 0 end' reports/gitleaks-report.json 2>/dev/null || echo 0) - path = Path("reports/gitleaks-report.json") - try: - data = json.loads(path.read_text()) - print(len(data) if isinstance(data, list) else 0) - except Exception: - print(0) - PY - ) - - echo "findings_count=${FINDINGS_COUNT}" >> "$GITHUB_OUTPUT" - - if [ "${{ inputs.fail_on_findings }}" = "true" ] && [ "$FINDINGS_COUNT" -gt 0 ]; then - echo "Gitleaks found ${FINDINGS_COUNT} potential secrets." - exit 1 - fi - - if [ "$EXIT_CODE" -ne 0 ] && [ "$FINDINGS_COUNT" -eq 0 ]; then - echo "Gitleaks exited with code $EXIT_CODE but no findings were parsed." - exit "$EXIT_CODE" - fi + echo "findings_count=${FINDINGS_COUNT}" >> "$GITHUB_OUTPUT" + + if [ "${{ inputs.fail_on_findings }}" = "true" ] && [ "$FINDINGS_COUNT" -gt 0 ]; then + echo "Gitleaks found ${FINDINGS_COUNT} potential secrets." + exit 1 + fi + + if [ "$EXIT_CODE" -ne 0 ] && [ "$FINDINGS_COUNT" -eq 0 ]; then + echo "Gitleaks exited with code $EXIT_CODE but no findings were parsed." + exit "$EXIT_CODE" + fi - name: Upload Gitleaks report if: always()