Files

75 lines
3.0 KiB
YAML

name: gitleaks
# Block PRs that introduce hardcoded credentials. Runs the gitleaks CLI
# directly (rather than gitleaks-action) because the action requires a
# paid license on GitHub Orgs. Same scanner, same rules, same .gitleaks.toml.
on:
pull_request:
branches: ['**']
push:
branches: [main, 'eric/**', 'haik/**', 'arnav/**']
permissions:
contents: read
jobs:
scan:
runs-on: ubuntu-latest
env:
GITLEAKS_VERSION: '8.21.2'
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history so PR-diff scanning works.
- name: Install gitleaks
run: |
set -euo pipefail
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
| tar -xz -C /tmp gitleaks
sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
gitleaks version
- name: Run gitleaks (PR diff)
if: github.event_name == 'pull_request'
run: |
gitleaks detect \
--source . \
--redact \
--verbose \
--no-banner \
--log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
- name: Run gitleaks (push)
if: github.event_name == 'push'
run: |
set -euo pipefail
BEFORE="${{ github.event.before }}"
AFTER="${{ github.sha }}"
# New-branch push (incl. a branch rename): GH sends 40 zeros for
# `before`. Diff against main's merge-base so we only scan commits
# unique to the branch. Fetch main at FULL depth, not --depth=1: a
# shallow main can't reach the fork point of a far-behind branch, so
# merge-base comes back empty and we'd full-rescan all of history.
if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
git fetch --no-tags origin main:refs/remotes/origin/main 2>/dev/null || true
if git rev-parse --verify origin/main >/dev/null 2>&1; then
BEFORE=$(git merge-base origin/main "$AFTER" 2>/dev/null || echo "")
fi
fi
if [ -n "$BEFORE" ] && [ "$BEFORE" != "$AFTER" ]; then
gitleaks detect --source . --redact --verbose --no-banner --log-opts="${BEFORE}..${AFTER}"
elif [ "$BEFORE" = "$AFTER" ]; then
# New-branch push pointing at an existing main commit: range
# is empty, nothing new to scan. Don't fall through to a full
# repo scan — that would re-flag every historical secret a
# past PR already cleared. Pass-through.
echo "No new commits on this branch vs main; skipping scan."
else
# Truly couldn't establish a range (e.g. orphan branch with
# no shared history). Full scan is the only safe option.
gitleaks detect --source . --redact --verbose --no-banner
fi