Repository navigation
ci: scan the commits of the PR with gitleaks - #6
Merged
Merged
Conversation
The gitleaks hook ran `gitleaks git --pre-commit --staged`. In CI, `prek run --all-files` runs on a fresh checkout with nothing staged, so the hook passed without scanning anything. The hook's entry is now .github/scripts/gitleaks-changes.sh. On commit it scans the staged changes (a merge commit: only what it introduces itself). In CI the general prek step skips gitleaks and a dedicated step runs it with GITLEAKS_BASE set to the PR base (or the commit before a push), so every commit of the PR is scanned, plus the lines merge commits introduced. A run without a base (workflow_dispatch) scans the whole history. Assisted-by: ClaudeCode:claude-sonnet-5-5
A manual run has no base to scan from. Drop workflow_dispatch from the standalone gitleaks workflows and skip the gitleaks step on a manual run of the lint workflow. Make the script fail on an empty GITLEAKS_BASE instead of falling back to a full-history scan, so a missing base can never pass silently. Assisted-by: ClaudeCode:claude-sonnet-5-5
Keep both the gitleaks step and the AI attribution step in the lint workflow. Assisted-by: ClaudeCode:claude-sonnet-5-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 AI text below 🤖
Problem
The gitleaks hook runs
gitleaks git --pre-commit --staged, which scans the staged diff. In CI,prek run --all-filesruns on a fresh checkout with nothing staged, so the hook passed without scanning anything. Secrets were only caught if someone hadprek installed locally.What changed
The hook's
entrynow points at.github/scripts/gitleaks-changes.sh(the script from U19-pipeline-python #154), which scans only what is being introduced:workflow_dispatch)In the lint workflow:
SKIP=gitleaks), since there it can only see staged changes;GITLEAKS_BASEset to the PR base commit (or the commit before a push); a missing base (first push of a branch, force-pushed base) scans the last commit only;fetch-depth: 0).Testing
With prek,
GITLEAKS_BASEset to the base and a token committed in the second of three commits,uvx prek run gitleaks --all-files --verbosefails with onegithub-patfinding (3 commits scanned). A clean range passes. The script was also exercised for: unset base with a staged leak (fails), unset base with nothing staged (passes), all-zeros base, and empty base.Assisted-by: ClaudeCode:claude-sonnet-5-5