Andriy Oblivantsev
78076ee5a9
Lint / Lint (push) Skipped
Release Please / Release Please (push) Skipped
Release / GoReleaser (push) Skipped
Tests / Test (Go 1.22 / ubuntu-latest) (push) Skipped
Tests / Test (Go 1.23 / ubuntu-latest) (push) Skipped
Tests / Test (Go stable / macos-latest) (push) Skipped
Tests / Test (Go stable / ubuntu-latest) (push) Skipped
Tests / Test (Go stable / windows-latest) (push) Skipped
Secret scan / Secret scan (gitleaks) (push) Successful in 4s
Secret scan / Secret scan (gitleaks) (pull_request) Successful in 3s
Tests / Test (Go 1.22 / ubuntu-latest) (pull_request) Successful in 13s
Tests / Test (Go 1.23 / ubuntu-latest) (pull_request) Successful in 15s
Lint / Lint (pull_request) Successful in 43s
Tests / Test (Go stable / ubuntu-latest) (pull_request) Successful in 22s
Tests / Test (Go stable / macos-latest) (pull_request) Canceled after 0s
Tests / Test (Go stable / windows-latest) (pull_request) Canceled after 0s
42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
name: Secret scan
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: Secret scan (gitleaks)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Compute scan range (diff of new commits only)
|
|
id: range
|
|
run: |
|
|
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
|
|
RANGE="${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}"
|
|
else
|
|
BEFORE="${{ github.event.before }}"
|
|
if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
|
|
RANGE="$(git rev-list --max-parents=0 HEAD | tail -1)..$GITHUB_SHA"
|
|
else
|
|
RANGE="$BEFORE..$GITHUB_SHA"
|
|
fi
|
|
fi
|
|
echo "RANGE=$RANGE" >> "$GITHUB_ENV"
|
|
echo "Scanning range: $RANGE"
|
|
|
|
- name: Gitleaks (diff-only, fail on leak)
|
|
uses: docker://zricethezav/gitleaks:latest
|
|
env:
|
|
GITLEAKS_RANGE: ${{ env.RANGE }}
|
|
with:
|
|
args: detect --source "${{ github.workspace }}" --log-opts="$GITLEAKS_RANGE" --redact --verbose
|