From 4e03a9b6817170b778856c709e93f1b55ae29b94 Mon Sep 17 00:00:00 2001
From: EllAchE <26192612+EllAchE@users.noreply.github.com>
Date: Tue, 21 Jul 2026 20:15:59 +0000
Subject: [PATCH] S-125938: add gitleaks secret scanning

---
 .github/workflows/gitleaks.yml | 54 ++++++++++++++++++++++++++++++++++
 .gitleaks.toml                 |  2 ++
 2 files changed, 56 insertions(+)
 create mode 100644 .github/workflows/gitleaks.yml
 create mode 100644 .gitleaks.toml

diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 0000000..43b7b62
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,54 @@
+name: Gitleaks
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  gitleaks:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no_gha') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Restore gitleaks config from base branch
+        if: github.event_name == 'pull_request'
+        run: |
+          if git show "origin/${{ github.base_ref }}:.gitleaks.toml" 2>/dev/null > .gitleaks.toml.base; then
+            mv .gitleaks.toml.base .gitleaks.toml
+          else
+            rm -f .gitleaks.toml.base
+            echo "No .gitleaks.toml on base branch; using checked-out copy (bootstrap)."
+          fi
+
+          if git show "origin/${{ github.base_ref }}:.gitleaksignore" 2>/dev/null > .gitleaksignore; then
+            echo "Loaded .gitleaksignore from base branch."
+          else
+            rm -f .gitleaksignore
+            echo "No .gitleaksignore on base branch; fingerprint suppression disabled."
+          fi
+
+      - name: Scan PR / pushed commits for secrets
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          if ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
+            BASE_SHA="$HEAD_SHA~1"
+          fi
+          gitleaks git --no-banner --redact --ignore-gitleaks-allow --config .gitleaks.toml \
+            --log-opts="$BASE_SHA..$HEAD_SHA"
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..5474857
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,2 @@
+[extend]
+useDefault = true