ci: drop the deprecated GITLEAKS_LICENSE secret mapping - #259
Conversation
Syncs netresearch/.github#330. Secret scanning runs on betterleaks, which is OSS and needs no license; the reusable declares GITLEAKS_LICENSE only for backwards compatibility and never reads it. Passing the secret was dead plumbing that widened the exposure surface for no benefit. Keeps this file byte-identical to the template, which the drift check enforces. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
🟢 Ready to approve
The change is a straightforward removal of unused secret plumbing and does not affect workflow structure or references elsewhere in the repo.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Removes the deprecated GITLEAKS_LICENSE secret forwarding from the gitleaks reusable-workflow job, aligning this repository’s workflow with the upstream template and reducing unnecessary secret exposure.
Changes:
- Deleted the
secrets:mapping that forwardedsecrets.GITLEAKS_LICENSEinto the reusablenetresearch/.github/.github/workflows/gitleaks.ymlworkflow.
File summaries
| File | Description |
|---|---|
| .github/workflows/gitleaks.yml | Removes unused GITLEAKS_LICENSE secret mapping from the reusable workflow job. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #259 +/- ##
=======================================
Coverage 74.70% 74.70%
=======================================
Files 10 10
Lines 427 427
=======================================
Hits 319 319
Misses 88 88
Partials 20 20
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Syncs the template change from netresearch/.github#330.
Secret scanning runs on betterleaks, which is OSS and needs no license.
The shared reusable declares
GITLEAKS_LICENSEonly for backwardscompatibility and never reads it, so forwarding a repo secret into it was
dead plumbing that widened the secret exposure surface for no benefit.
The file was byte-identical to the previous template revision before this
change, so the diff is exactly the removed
secrets:mapping — norepo-specific drift was touched. Required to keep
check-template-driftgreen.