eSlider
1607f760db
The docker://zricethezav/gitleaks action mounts the workspace at /github/workspace, but --source pointed at the host path from github.workspace ($HOME/runner/work/...), which does not exist inside the container -> 'stat ...: no such file or directory' on every run. Follow the 2dph canon (ci.yml secret-scan): install the gitleaks binary instead of the docker action and scan GITHUB_WORKSPACE - works on both GitHub and Gitea act runners.
54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
name: Secret scan
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: Secret scan (gitleaks)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Compute scan range (diff of new commits only)
|
|
id: range
|
|
run: |
|
|
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
|
|
RANGE="${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}"
|
|
else
|
|
BEFORE="${{ github.event.before }}"
|
|
if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
|
|
RANGE="$(git rev-list --max-parents=0 HEAD | tail -1)..$GITHUB_SHA"
|
|
else
|
|
RANGE="$BEFORE..$GITHUB_SHA"
|
|
fi
|
|
fi
|
|
echo "RANGE=$RANGE" >> "$GITHUB_ENV"
|
|
echo "Scanning range: $RANGE"
|
|
|
|
- name: Gitleaks (diff-only, fail on leak)
|
|
env:
|
|
GITLEAKS_RANGE: ${{ env.RANGE }}
|
|
run: |
|
|
set -euo pipefail
|
|
# install the gitleaks binary (linux-amd64) instead of a docker action:
|
|
# the docker://zricethezav/gitleaks action hardcodes /github/workspace,
|
|
# which does not exist on the Gitea (act) runner. $GITHUB_WORKSPACE is the
|
|
# checkout dir on BOTH runners (GitHub and Gitea act).
|
|
curl -fsSLo /tmp/gitleaks.tar.gz \
|
|
https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
|
|
tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
|
|
chmod +x /tmp/gitleaks
|
|
/tmp/gitleaks detect \
|
|
--source "$GITHUB_WORKSPACE" \
|
|
--log-opts="$GITLEAKS_RANGE" \
|
|
--redact \
|
|
--verbose
|