gitleaks.yml

name: gitleaks
on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: gitleaks-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Download and verify gitleaks CLI
        env:
          GITLEAKS_VERSION: 8.30.1
          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
        run: |
          set -euo pipefail
          archive="${RUNNER_TEMP}/gitleaks.tar.gz"
          install_dir="${RUNNER_TEMP}/gitleaks-bin"
          curl --fail --location --silent --show-error \
            --proto '=https' --tlsv1.2 \
            --retry 3 \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            --output "${archive}"
          printf '%s  %s\n' "${GITLEAKS_SHA256}" "${archive}" | sha256sum --check --strict
          mkdir -p "${install_dir}"
          tar -xzf "${archive}" -C "${install_dir}" gitleaks
          printf '%s\n' "${install_dir}" >> "${GITHUB_PATH}"

      - name: Run gitleaks (history scan)
        run: |
          gitleaks git --redact --log-opts="--all" \
            --config .gitleaks.toml \
            --report-format=sarif --report-path=results.sarif --exit-code=1 .

      - name: Upload SARIF report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: gitleaks-results
          path: results.sarif