34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
# Secret scanning with gitleaks over the repository's full git history.
|
|
#
|
|
# Full history rather than the pushed range: a push range is unreliable on
|
|
# force-pushes and first pushes, and these repos are small enough that a full
|
|
# scan takes seconds. A secret that was committed and later deleted is still
|
|
# exposed, so history is exactly what needs scanning.
|
|
#
|
|
# The calling repo controls what counts as a finding:
|
|
# .gitleaks.toml extra rules or allowlists, picked up automatically
|
|
# .gitleaksignore fingerprints of accepted findings, one per line, as
|
|
# printed in the "Fingerprint:" line of this job's output
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
log-opts:
|
|
description: Extra `git log` options to narrow the scan, e.g. a commit range. Empty scans all history.
|
|
type: string
|
|
default: ""
|
|
|
|
jobs:
|
|
gitleaks:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
fetch-depth: 0
|
|
- name: gitleaks
|
|
env:
|
|
LOG_OPTS: ${{ inputs.log-opts }}
|
|
run: |
|
|
gitleaks version
|
|
set -- git --redact --verbose --no-banner --exit-code 1
|
|
if [ -n "$LOG_OPTS" ]; then set -- "$@" --log-opts "$LOG_OPTS"; fi
|
|
gitleaks "$@" .
|