gitleaks.yml

name: Gitleaks

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: gitleaks-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
        with:
          # Full history for `gitleaks detect --log-opts="--all"` on push to main.
          # PR runs only need the diff range (resolved below).
          fetch-depth: 0

      - name: Install gitleaks (pinned + checksum-verified)
        # GITLEAKS_SHA256 is the SHA-256 of gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz
        # from the upstream gitleaks_${GITLEAKS_VERSION}_checksums.txt file. Without
        # this, a poisoned GitHub release would silently install a backdoored gitleaks
        # on every CI run. When bumping GITLEAKS_VERSION, fetch the upstream checksum
        # in the same commit; reviewers should re-fetch and confirm.
        env:
          GITLEAKS_VERSION: '8.30.1'
          GITLEAKS_SHA256: '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb'
        run: |
          set -euo pipefail
          TARBALL=/tmp/gitleaks.tar.gz
          curl -sSL -o "$TARBALL" \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          echo "${GITLEAKS_SHA256}  ${TARBALL}" | sha256sum -c -
          tar -xz -C /tmp -f "$TARBALL" gitleaks
          sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
          gitleaks version

      - name: Detect secrets
        # --redact masks any matched secret in CI logs.
        # PR: scan only the diff range to keep PR cycles fast.
        # push to main: scan full history to catch any rewrites.
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            gitleaks detect \
              --source=. \
              --no-banner \
              --redact \
              --log-opts="origin/${{ github.base_ref }}..HEAD" \
              --report-format json \
              --report-path /tmp/leaks.json \
              -v
          else
            gitleaks detect \
              --source=. \
              --no-banner \
              --redact \
              --log-opts="--all" \
              --report-format json \
              --report-path /tmp/leaks.json \
              -v
          fi