|
| 1 | +name: Gitleaks secrets scan |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + branches: |
| 6 | + - v2 |
| 7 | + |
| 8 | +permissions: |
| 9 | + issues: write |
| 10 | + pull-requests: write |
| 11 | + contents: read |
| 12 | + |
| 13 | +jobs: |
| 14 | + gitleaks: |
| 15 | + runs-on: ubuntu-latest |
| 16 | + |
| 17 | + steps: |
| 18 | + - name: Checkout code |
| 19 | + uses: actions/checkout@v4 |
| 20 | + with: |
| 21 | + fetch-depth: 0 # Required to get full commit history for diffing |
| 22 | + |
| 23 | + |
| 24 | + - name: Get base and head commit SHAs |
| 25 | + run: | |
| 26 | + echo "BASE_SHA=${{ github.event.pull_request.base.sha }}" >> $GITHUB_ENV |
| 27 | + echo "HEAD_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV |
| 28 | +
|
| 29 | + |
| 30 | + - name: Run Gitleaks on PR changes via Docker |
| 31 | + run: | |
| 32 | + docker run --rm -v $(pwd):/repo -w /repo zricethezav/gitleaks:latest detect \ |
| 33 | + --config="/repo/Rule/gitleaks.toml" \ |
| 34 | + --log-opts="--no-merges $BASE_SHA..$HEAD_SHA" \ |
| 35 | + --verbose \ |
| 36 | + --exit-code=0 \ |
| 37 | + --report-format=json \ |
| 38 | + --report-path="/repo/gitleaks-report.json" \ |
| 39 | + --redact |
| 40 | +
|
| 41 | + - name: Upload Gitleaks report |
| 42 | + uses: actions/upload-artifact@v4 |
| 43 | + with: |
| 44 | + name: gitleaks-report |
| 45 | + path: gitleaks-report.json |
| 46 | + |
| 47 | + - name: Format and comment findings on PR |
| 48 | + env: |
| 49 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 50 | + run: | |
| 51 | + if [ ! -f gitleaks-report.json ]; then |
| 52 | + echo "Report file not found!" |
| 53 | + exit 1 |
| 54 | + fi |
| 55 | +
|
| 56 | + FINDINGS_JSON=$(cat gitleaks-report.json) |
| 57 | + COUNT=$(echo "$FINDINGS_JSON" | jq 'length') |
| 58 | + SHA="${{ github.event.pull_request.head.sha }}" |
| 59 | + REPO="${{ github.repository }}" |
| 60 | + PR_NUMBER="${{ github.event.pull_request.number }}" |
| 61 | + MAX=10 |
| 62 | +
|
| 63 | + if [ "$COUNT" -gt 0 ]; then |
| 64 | + COMMENT="**🔐 Gitleaks Findings: $COUNT issue(s) detected**\n\n" |
| 65 | + i=0 |
| 66 | + while [ "$i" -lt "$COUNT" ] && [ "$i" -lt "$MAX" ]; do |
| 67 | + ITEM=$(echo "$FINDINGS_JSON" | jq ".[$i]") |
| 68 | + RULE=$(echo "$ITEM" | jq -r '.RuleID') |
| 69 | + DESC=$(echo "$ITEM" | jq -r '.Description') |
| 70 | + FILE=$(echo "$ITEM" | jq -r '.File') |
| 71 | + LINE=$(echo "$ITEM" | jq -r '.Line') |
| 72 | + LINK="https://github.com/$REPO/blob/$SHA/$FILE#L$LINE" |
| 73 | + SECRET_MASKED="**********" |
| 74 | + COMMENT+="🔸 **Rule**: \`$RULE\`\n" |
| 75 | + COMMENT+="📄 **File**: \`$FILE:$LINE\`\n" |
| 76 | + COMMENT+="📝 **Description**: $DESC\n" |
| 77 | + COMMENT+="🔑 **Secret**: \`$SECRET_MASKED\`\n" |
| 78 | + COMMENT+="🔗 **Path**: [$FILE:$LINE]($LINK)\n\n" |
| 79 | + i=$((i + 1)) |
| 80 | + done |
| 81 | +
|
| 82 | + if [ "$COUNT" -gt "$MAX" ]; then |
| 83 | + COMMENT+="...and more. Only showing first $MAX findings.\n" |
| 84 | + fi |
| 85 | + else |
| 86 | + COMMENT="✅ **Gitleaks Findings:** No secrets detected. Safe to proceed!" |
| 87 | + fi |
| 88 | +
|
| 89 | + # Escape newlines for GitHub API |
| 90 | + COMMENT=$(echo "$COMMENT" | sed ':a;N;$!ba;s/\n/\\n/g') |
| 91 | +
|
| 92 | + curl -X POST \ |
| 93 | + -H "Authorization: token $GITHUB_TOKEN" \ |
| 94 | + -H "Accept: application/vnd.github.v3+json" \ |
| 95 | + -d "{\"body\":\"$COMMENT\"}" \ |
| 96 | + "https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments" |
0 commit comments