Merge pull request #2914 from maziyarpanahi/feature/issue-919-key-lif… #2384
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| on: | |
| push: | |
| branches: [ main, master, develop ] | |
| pull_request: | |
| branches: [ main, master, develop ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| GITLEAKS_LINUX_X64_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| archive="/tmp/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -sSfL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| -o "$archive" | |
| echo "${GITLEAKS_LINUX_X64_SHA256} $archive" | sha256sum -c - | |
| tar -xzf "$archive" -C /tmp gitleaks | |
| sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks | |
| gitleaks version | |
| - name: Verify secret scanner canary | |
| run: | | |
| canary_dir="$(mktemp -d)" | |
| cp tests/fixtures/secret_scan_canary.txt "$canary_dir/canary.txt" | |
| set +e | |
| gitleaks dir \ | |
| --config .gitleaks.toml \ | |
| --redact \ | |
| --no-banner \ | |
| --report-format json \ | |
| --report-path "$RUNNER_TEMP/gitleaks-canary.json" \ | |
| "$canary_dir" | |
| canary_status=$? | |
| set -e | |
| if [ "$canary_status" -eq 0 ]; then | |
| echo "::error title=Secret scanner canary was not detected::Expected the synthetic canary to fail outside its allowlisted fixture path" | |
| exit 1 | |
| fi | |
| if [ "$canary_status" -ne 1 ]; then | |
| echo "::error title=Secret scanner canary failed unexpectedly::Scanner exited with status $canary_status" | |
| exit "$canary_status" | |
| fi | |
| - name: Scan committed changes for secrets | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BEFORE_SHA: ${{ github.event.before }} | |
| run: | | |
| zero_sha="0000000000000000000000000000000000000000" | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| scan_range="${PR_BASE_SHA}..${PR_HEAD_SHA}" | |
| elif [ -n "$PUSH_BEFORE_SHA" ] && [ "$PUSH_BEFORE_SHA" != "$zero_sha" ]; then | |
| scan_range="${PUSH_BEFORE_SHA}..${GITHUB_SHA}" | |
| else | |
| scan_range="${GITHUB_SHA}^..${GITHUB_SHA}" | |
| fi | |
| gitleaks git \ | |
| --config .gitleaks.toml \ | |
| --baseline-path .secrets.baseline \ | |
| --redact \ | |
| --no-banner \ | |
| --verbose \ | |
| --log-opts "$scan_range" \ | |
| . |