Repository navigation
ci: add a gitleaks workflow that scans the commits of each PR - #1
Merged
Merged
Conversation
Add a gitleaks workflow. On a PR (or push) it scans every commit since the base, plus the lines merge commits introduced themselves, via .github/scripts/gitleaks-changes.sh. A manual run (workflow_dispatch) scans the whole history. The gitleaks binary is pinned to 8.30.1 and its sha256 is checked before it is used. Assisted-by: ClaudeCode:claude-sonnet-5-5
A manual run has no base to scan from. Drop workflow_dispatch from the standalone gitleaks workflows and skip the gitleaks step on a manual run of the lint workflow. Make the script fail on an empty GITLEAKS_BASE instead of falling back to a full-history scan, so a missing base can never pass silently. Assisted-by: ClaudeCode:claude-sonnet-5-5
Do not fall back to a full-history scan, so a missing base can never pass silently. Assisted-by: ClaudeCode:claude-sonnet-5-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 AI text below 🤖
Problem
This repo has no secret scanning in CI.
What changed
Adds a
gitleaksworkflow (and.github/scripts/gitleaks-changes.sh, the same script used in U19-pipeline-python). On a pull request or push it scans every commit since the base, plus the lines each merge commit introduced itself, so a secret typed in while resolving a conflict is caught too. It does not rescan old history on every run. There is no manual-run trigger: a run without a base to scan from could not check anything.permissions: contents: read,persist-credentials: false;zizmorreports no findings.gitleaksjob is not a required check (no ruleset on this repo).Testing
The script was run against a scratch repo: a PR range with a token committed in an earlier commit fails (1
github-patfinding); an unchanged range, an all-zeros base and a clean range pass; an empty base fails. The install step was run with the real and a wrong checksum.Assisted-by: ClaudeCode:claude-sonnet-5-5