pipeline(secu): manage 'invalid revision range' when updating branche

.github/workflows/gitleaks-analysis.yml

@@ -6,19 +6,55 @@ on:
 jobs:
   secret-scan:
     name: Run Gitleaks
-    runs-on: ${{ (github.repository_visibility != 'public' && github.repository_owner == 'centreon') && 'centreon-security' || 'ubuntu-24.04' }}
+    runs-on: ${{ ((github.repository_owner == 'centreon' || github.repository_owner == 'quanta-computing') && github.repository_visibility != 'public') && 'centreon-security' || 'ubuntu-24.04' }}
 
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest \
+            | grep '"tag_name"' | sed 's/.*"v\([^"]*\)".*/\1/')
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          echo "Gitleaks $(gitleaks version) installed"
+
       - name: Run secret scan
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: "Centreon"
           GITLEAKS_ENABLE_COMMENTS: false
           GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
           GITLEAKS_ENABLE_SUMMARY: false
+          HEAD: "${{ github.event.pull_request.head.sha || github.sha }}"
+          BASE_SHA: "${{ github.event.pull_request.base.sha }}"
+        run: |
+          BASE=$(git merge-base "${BASE_SHA}" "${HEAD}")
+
+          echo "Scanning range: ${BASE}..${HEAD}"
+
+          gitleaks detect \
+            --source . \
+            --log-opts="--no-merges --first-parent ${BASE}..${HEAD}" \
+            --exit-code=2 \
+            --redact \
+            --verbose
+          EXIT_CODE=$?
+
+          if [ $EXIT_CODE -eq 0 ]; then
+            echo "No secrets found."
+          elif [ $EXIT_CODE -eq 1 ]; then
+            # Code 1 = invalid revision range, merge commit, etc.
+            echo "::warning::Gitleaks encountered a git error (exit code: ${EXIT_CODE}). Likely an invalid revision range due to a merge commit. Scan skipped for this run."
+            exit 0
+          elif [ $EXIT_CODE -eq 2 ]; then
+            echo "::error::Gitleaks has detected secrets in this branch!"
+            exit 1
+          else
+            # Code 128 = missing commit in history or unmanaged case
+            echo "::error::Gitleaks encountered an internal error (exit code: ${EXIT_CODE}). Contact the security team to investigate."
+            exit 1
+          fi