# gitleaks secret scan - runs on every push and pull request.

name: gitleaks

on:
  push:
  pull_request:

jobs:
  scan:
    runs-on: lucy-rust
    container:
      image: git.sulkta.com/sulkta-infra/ci-buildah:latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Full history — gitleaks needs depth to scan a commit range.
          fetch-depth: 0

      - name: install gitleaks
        run: |
          set -euo pipefail
          # Pinned gitleaks release + sha256 (from gitleaks_8.21.2_checksums.txt,
          # verified 2026-09-06). sha256sum -c gates extraction on a match.
          gitleaks_version=8.21.2
          gitleaks_sha256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba
          curl -sSL -o gl.tar.gz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${gitleaks_version}/gitleaks_${gitleaks_version}_linux_x64.tar.gz"
          echo "${gitleaks_sha256}  gl.tar.gz" | sha256sum -c -
          tar xzf gl.tar.gz gitleaks
          chmod +x gitleaks
          ./gitleaks version

      - name: scan
        run: |
          ./gitleaks detect --source . --no-banner --redact --verbose