22 lines
811 B
YAML
22 lines
811 B
YAML
name: Secret scan
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
gitleaks:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Scan new commits
|
|
env:
|
|
RANGE: ${{ github.event_name == 'pull_request' && format('{0}..{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.sha) }}
|
|
run: |
|
|
case "$RANGE" in 0000000000000000000000000000000000000000..*) RANGE="${GITHUB_SHA}~1..${GITHUB_SHA}" ;; esac
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar xz gitleaks
|
|
./gitleaks git --redact --no-banner --log-opts="$RANGE" .
|