chore: stop forwarding the deprecated GITLEAKS_LICENSE secret - #91
Merged
Conversation
Secret scanning runs on betterleaks, which is OSS and needs no license. The shared gitleaks reusable declares GITLEAKS_LICENSE only for backwards compatibility and never reads it, and the org-level secret has been deleted, so this workflow was handing an empty value to an input that ignores it. Only the mapping line is removed; the enclosing `secrets:` key goes with it only when nothing else was left under it. Other secrets in the same block are untouched. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
There was a problem hiding this comment.
Pull request overview
This PR removes forwarding of the deprecated GITLEAKS_LICENSE secret from the Security workflow when calling the shared secret-scanning reusable workflow, aligning the caller with the current betterleaks-based implementation (which doesn’t need a license).
Changes:
- Removed the
secrets:block that forwardedGITLEAKS_LICENSEinto the reusablegitleaks.ymlworkflow. - Simplified the
gitleaksjob configuration by omitting an now-unneeded secret mapping.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the
GITLEAKS_LICENSEmapping this workflow passes into the shared secret-scanning reusable.Secret scanning runs on betterleaks, which is OSS and needs no licence. The reusable declares
GITLEAKS_LICENSEpurely for backwards compatibility and never reads it — and the org-level secret has since been deleted, so what this workflow forwards today is an empty string into an input that ignores it.Only the mapping line is removed. The enclosing
secrets:key is dropped only where nothing else remained under it; any other secret in the same block is untouched.Part of finishing the betterleaks/zizmor rollout (netresearch/.github#327, #330). Once no caller forwards the secret, the compatibility declarations in the reusables can be removed too.