mirror of
https://github.com/openswarm-ai/openswarm.git
synced 2026-08-21 12:12:22 +02:00
ciregenz
a5277cb732
Workflow's new-branch fallback fell through to a full repo scan whenever merge-base with main equaled HEAD (empty range). That re-flagged every historical secret a prior PR had already cleared. Now: empty range means nothing new to scan, log + exit clean. Genuine no-shared-history case still falls through to full scan.
73 lines
2.8 KiB
YAML
73 lines
2.8 KiB
YAML
name: gitleaks
|
|
|
|
# Block PRs that introduce hardcoded credentials. Runs the gitleaks CLI
|
|
# directly (rather than gitleaks-action) because the action requires a
|
|
# paid license on GitHub Orgs. Same scanner, same rules, same .gitleaks.toml.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: ['**']
|
|
push:
|
|
branches: [main, 'eric/**', 'haik/**', 'arnav/**']
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
GITLEAKS_VERSION: '8.21.2'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # Full history so PR-diff scanning works.
|
|
|
|
- name: Install gitleaks
|
|
run: |
|
|
set -euo pipefail
|
|
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
|
|
| tar -xz -C /tmp gitleaks
|
|
sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
|
|
gitleaks version
|
|
|
|
- name: Run gitleaks (PR diff)
|
|
if: github.event_name == 'pull_request'
|
|
run: |
|
|
gitleaks detect \
|
|
--source . \
|
|
--redact \
|
|
--verbose \
|
|
--no-banner \
|
|
--log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
|
|
|
|
- name: Run gitleaks (push)
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
set -euo pipefail
|
|
BEFORE="${{ github.event.before }}"
|
|
AFTER="${{ github.sha }}"
|
|
# New-branch push: GH sends 40 zeros for `before`. Diff against
|
|
# main's merge-base instead so we only scan commits unique to the
|
|
# branch — fast and matches the gitleaks-action default.
|
|
if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
|
|
git fetch --no-tags --depth=1 origin main:refs/remotes/origin/main 2>/dev/null || true
|
|
if git rev-parse --verify origin/main >/dev/null 2>&1; then
|
|
BEFORE=$(git merge-base origin/main "$AFTER" 2>/dev/null || echo "")
|
|
fi
|
|
fi
|
|
if [ -n "$BEFORE" ] && [ "$BEFORE" != "$AFTER" ]; then
|
|
gitleaks detect --source . --redact --verbose --no-banner --log-opts="${BEFORE}..${AFTER}"
|
|
elif [ "$BEFORE" = "$AFTER" ]; then
|
|
# New-branch push pointing at an existing main commit: range
|
|
# is empty, nothing new to scan. Don't fall through to a full
|
|
# repo scan — that would re-flag every historical secret a
|
|
# past PR already cleared. Pass-through.
|
|
echo "No new commits on this branch vs main; skipping scan."
|
|
else
|
|
# Truly couldn't establish a range (e.g. orphan branch with
|
|
# no shared history). Full scan is the only safe option.
|
|
gitleaks detect --source . --redact --verbose --no-banner
|
|
fi
|