Cobb
b64861cd63
All checks were successful
gitleaks / scan (push) Successful in 26s
The gitleaks job used runs-on: ubuntu-latest, which the forgejo-runner maps to the retired crafting-table:local image -> every run has failed silently since ~July (secret-scan layer 1 effectively off). Run on lucy-rust in ci-buildah (has node for actions/checkout + curl), and sha256-verify the pinned gitleaks 8.21.2 tarball before extracting.
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
# gitleaks secret scan - runs on every push and pull request.
|
|
|
|
name: gitleaks
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: lucy-rust
|
|
container:
|
|
image: git.sulkta.com/sulkta-infra/ci-buildah:latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Full history — gitleaks needs depth to scan a commit range.
|
|
fetch-depth: 0
|
|
|
|
- name: install gitleaks
|
|
run: |
|
|
set -euo pipefail
|
|
# Pinned gitleaks release + sha256 (from gitleaks_8.21.2_checksums.txt,
|
|
# verified 2026-09-06). sha256sum -c gates extraction on a match.
|
|
gitleaks_version=8.21.2
|
|
gitleaks_sha256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba
|
|
curl -sSL -o gl.tar.gz \
|
|
"https://github.com/gitleaks/gitleaks/releases/download/v${gitleaks_version}/gitleaks_${gitleaks_version}_linux_x64.tar.gz"
|
|
echo "${gitleaks_sha256} gl.tar.gz" | sha256sum -c -
|
|
tar xzf gl.tar.gz gitleaks
|
|
chmod +x gitleaks
|
|
./gitleaks version
|
|
|
|
- name: scan
|
|
run: |
|
|
./gitleaks detect --source . --no-banner --redact --verbose
|