Merge pull request #2679 from copse-dev/copse/tell-me-what-has-landed… #5574
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret scan | |
| on: | |
| push: | |
| branches: [release, main] | |
| pull_request: | |
| # `main` is the default branch and where day-to-day PRs land, so it must | |
| # be listed or fork PRs — the ones this standalone job exists for — would go | |
| # unscanned entirely once PRs stopped targeting `release`. | |
| branches: [release, main] | |
| schedule: | |
| - cron: '41 6 * * 1' | |
| # Same-repository PRs scan inside CI's existing self-hosted precheck. This | |
| # standalone hosted job remains for main pushes, the weekly safety net, and fork | |
| # PRs, which receive only the default read token and must never reach the | |
| # self-hosted fleet. | |
| permissions: | |
| contents: read | |
| env: | |
| GITLEAKS_VERSION: 8.30.1 | |
| GITLEAKS_LINUX_X64_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb | |
| jobs: | |
| gitleaks: | |
| name: Scan repository history | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # gitleaks-action v2 requires a separate license for organization-owned | |
| # repositories. Run the open-source CLI directly and verify the pinned | |
| # release asset before executing it instead. | |
| - name: Install pinned gitleaks CLI | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| path="${RUNNER_TEMP}/${archive}" | |
| curl --fail --location --retry 3 \ | |
| --output "${path}" \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}" | |
| echo "${GITLEAKS_LINUX_X64_SHA256} ${path}" | sha256sum --check --strict | |
| tar -xzf "${path}" -C "${RUNNER_TEMP}" gitleaks | |
| "${RUNNER_TEMP}/gitleaks" version | |
| # Default `gitleaks git` implies `--all --full-history`, which also walks | |
| # every ref fetched by `fetch-depth: 0` — including machine-managed branches | |
| # like `demo-previews` whose minified bundles trip entropy heuristics and | |
| # fail unrelated PR tips (seen on #1192 via commit 22623c71). Keep the same | |
| # history/diff filters, but limit the walk to the checked-out tip (PR merge | |
| # commit or `main`) so preview artifacts cannot poison other scans. | |
| - name: Scan repository history | |
| run: | | |
| "${RUNNER_TEMP}/gitleaks" git --redact --verbose --no-banner \ | |
| --log-opts="--full-history --diff-filter=tuxdb HEAD" . |