# Secret scanning with gitleaks over the repository's full git history.
#
# Full history rather than the pushed range: a push range is unreliable on
# force-pushes and first pushes, and these repos are small enough that a full
# scan takes seconds. A secret that was committed and later deleted is still
# exposed, so history is exactly what needs scanning.
#
# The calling repo controls what counts as a finding:
#   .gitleaks.toml     extra rules or allowlists, picked up automatically
#   .gitleaksignore    fingerprints of accepted findings, one per line, as
#                      printed in the "Fingerprint:" line of this job's output
on:
  workflow_call:
    inputs:
      log-opts:
        description: Extra `git log` options to narrow the scan, e.g. a commit range. Empty scans all history.
        type: string
        default: ""

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0
      - name: gitleaks
        env:
          LOG_OPTS: ${{ inputs.log-opts }}
        run: |
          gitleaks version
          set -- git --redact --verbose --no-banner --exit-code 1
          if [ -n "$LOG_OPTS" ]; then set -- "$@" --log-opts "$LOG_OPTS"; fi
          gitleaks "$@" .