Skip to content

Commit ce25b14

Browse files
DariuszPorowskiDariuszPorowski
authored
Refresh after gitleaks rebranding (#63)
- changed pointers new gitleaks repo (zricethezav/gitleaks -> gitleaks/gitleaks) - changed action to self-build docker image instead of pulling from GH packages - changed gitleaks docker source to docker hub (looks like official ghcr is not updated after the gitleaks rebranding) - improved allowlisted for extended toml config - added gitleaks `--baseline-path` support - added dependabot support to the repo - minor dev experience improvements - files lint
1 parent 88923d9 commit ce25b14

10 files changed

+167
-88
lines changed

‎.editorconfig

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
trim_trailing_whitespace = true
7+
insert_final_newline = true
8+
indent_style = space
9+
indent_size = 2
10+
11+
[*.{cmd,bat}]
12+
end_of_line = crlf
13+
14+
[*.{yml,yaml,md,js,ts}]
15+
indent_style = space
16+
indent_size = 2
17+
18+
[*.toml]
19+
indent_style = space
20+
indent_size = 4

‎.gitattributes

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Set default behaviour to automatically normalize line endings.
2+
* text=auto
3+
4+
# Declare files that will always have LF line endings on checkout.
5+
*.sh text eol=lf
6+
7+
# Declare files that will always have CRLF line endings on checkout.
8+
*.sln text eol=crlf
9+
*.{cmd,[cC][mM][dD]} text eol=crlf
10+
*.{bat,[bB][aA][tT]} text eol=crlf
11+
12+
# Common files config
13+
*.md text eol=lf
14+
*.pdf binary
15+
*.gif binary
16+
*.ico binary
17+
*.jpg binary
18+
*.png binary

‎.github/dependabot.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: daily
7+
commit-message:
8+
prefix: "[github-actions] "
9+
10+
- package-ecosystem: docker
11+
directory: /
12+
schedule:
13+
interval: daily
14+
commit-message:
15+
prefix: "[docker] "

‎.github/workflows/docker.yml

+14-13
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: docker
1+
name: Update docker
22

33
on:
44
push:
@@ -17,6 +17,7 @@ on:
1717

1818
jobs:
1919
docker:
20+
name: Cache latest docker image
2021
runs-on: ubuntu-latest
2122
steps:
2223
- name: Get repo owner
@@ -36,51 +37,51 @@ jobs:
3637
- name: Fetch Gitleaks the latest release
3738
id: gitleaks_latest_release
3839
run: |
39-
gitleaks_latest_tag=$(gh api repos/zricethezav/gitleaks/releases/latest --jq .tag_name)
40+
gitleaks_latest_tag=$(gh api repos/gitleaks/gitleaks/releases/latest --jq .tag_name)
4041
gitleaks_latest_semver=$(echo ${gitleaks_latest_tag} | tr -d "v")
4142
echo "tag=${gitleaks_latest_tag}" >>$GITHUB_OUTPUT
4243
echo "semver=${gitleaks_latest_semver}" >>$GITHUB_OUTPUT
4344
env:
44-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
GITHUB_TOKEN: ${{ github.token }}
4546

4647
- name: Check - upgrade Gitleaks or not
4748
id: gitleaks_upgrade
48-
if: github.event_name == 'schedule'
49+
if: ${{ github.event_name == 'schedule' }}
4950
run: |
5051
pkgs=$(gh api /users/${{ steps.repo_owner.outputs.result }}/packages/container/${{ steps.repo_name.outputs.result }}/versions --jq '[.[] | select(.metadata.container.tags | index("${{ steps.gitleaks_latest_release.outputs.semver }}"))] | length')
5152
if [ $pkgs = 0 ]
5253
then
5354
echo "upgrade=true" >>$GITHUB_OUTPUT
5455
fi
5556
env:
56-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
GITHUB_TOKEN: ${{ github.token }}
5758

5859
- name: Check - upgrade Docker image or not
5960
id: upgrade
60-
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (github.event_name == 'schedule' && steps.gitleaks_upgrade.outputs.upgrade == 'true')
61+
if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (github.event_name == 'schedule' && steps.gitleaks_upgrade.outputs.upgrade == 'true') }}
6162
run: |
6263
echo "upgrade=true" >>$GITHUB_OUTPUT
6364
6465
- name: Checkout Git repo
65-
if: steps.upgrade.outputs.upgrade == 'true'
66+
if: ${{ steps.upgrade.outputs.upgrade == 'true' }}
6667
uses: actions/checkout@v3
6768

6869
# - name: Update config to the release version
69-
# if: steps.upgrade.outputs.upgrade == 'true'
70+
# if: ${{ steps.upgrade.outputs.upgrade == 'true' }}
7071
# run: |
7172
# curl --output "${GITHUB_WORKSPACE}/.gitleaks/gitleaks.toml" https://raw.githubusercontent.com/zricethezav/gitleaks/${{ steps.gitleaks_latest_release.outputs.tag }}/config/gitleaks.toml
7273

7374
- name: Login to ghcr.io
7475
uses: docker/login-action@v2
75-
if: steps.upgrade.outputs.upgrade == 'true'
76+
if: ${{ steps.upgrade.outputs.upgrade == 'true' }}
7677
with:
7778
registry: ghcr.io
7879
username: ${{ github.actor }}
79-
password: ${{ secrets.GITHUB_TOKEN }}
80+
password: ${{ github.token }}
8081

8182
- name: Prepare Docker image metadata
8283
uses: docker/metadata-action@v4
83-
if: steps.upgrade.outputs.upgrade == 'true'
84+
if: ${{ steps.upgrade.outputs.upgrade == 'true' }}
8485
with:
8586
images: "ghcr.io/${{ steps.repo_owner.outputs.result }}/${{ steps.repo_name.outputs.result }}"
8687
flavor: latest=true
@@ -91,8 +92,8 @@ jobs:
9192
id: docker_image_metadata
9293

9394
- name: Build and push Docker image
94-
if: steps.upgrade.outputs.upgrade == 'true'
95-
uses: docker/build-push-action@v3
95+
if: ${{ steps.upgrade.outputs.upgrade == 'true' }}
96+
uses: docker/build-push-action@v4
9697
with:
9798
tags: ${{ steps.docker_image_metadata.outputs.tags }}
9899
labels: ${{ steps.docker_image_metadata.outputs.labels }}

‎.github/workflows/dogfood.yml

+28-4
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,34 @@
1-
name: dog food
1+
name: dog food - tests
22

3-
on: [push, pull_request, workflow_dispatch]
3+
on: [push, pull_request, pull_request_target, workflow_dispatch]
4+
5+
# Allow one concurrent deployment
6+
concurrency:
7+
group: ${{ github.event_name }}-${{ github.base_ref }}-${{ github.head_ref || github.event.number }}
8+
cancel-in-progress: true
49

510
jobs:
11+
ghdiag:
12+
name: Run GitHub diagnostic
13+
if: ${{ vars.ACTIONS_RUNNER_DEBUG || vars.ACTIONS_STEP_DEBUG }}
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Dump
17+
uses: actions/github-script@v6
18+
with:
19+
script: |
20+
core.debug('!!! START github START !!!')
21+
core.info(JSON.stringify(github, null, ' '))
22+
core.debug('!!! END github END !!!')
23+
24+
core.debug('!!! START context START !!!')
25+
core.info(JSON.stringify(context, null, ' '))
26+
core.debug('!!! END context END !!!')
27+
- run: printenv
28+
629
gitleaks:
730
runs-on: ubuntu-latest
31+
name: Run Gitleaks
832
steps:
933
- name: Checkout
1034
uses: actions/checkout@v3
@@ -13,7 +37,7 @@ jobs:
1337

1438
- name: Run Gitleaks
1539
id: gitleaks
16-
uses: DariuszPorowski/github-action-gitleaks@v2
40+
uses: ./
1741
with:
1842
report_format: sarif
1943
fail: false
@@ -27,7 +51,7 @@ jobs:
2751
echo "report: ${{ steps.gitleaks.outputs.report }}"
2852
2953
- name: Upload SARIF report
30-
if: steps.gitleaks.outputs.exitcode == 1
54+
if: ${{ steps.gitleaks.outputs.exitcode == 1 }}
3155
uses: github/codeql-action/upload-sarif@v2
3256
with:
3357
sarif_file: ${{ steps.gitleaks.outputs.report }}

‎.gitleaks/UDMSecretChecks.toml

+3-9
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ title = "gitleaks config"
22

33
[extend]
44
# useDefault will extend the base configuration with the default gitleaks config:
5-
# https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml
5+
# https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
66
useDefault = true
77

88
[[rules]]
@@ -331,18 +331,12 @@ path = '''\.(?:ps1|psm1|js|json|coffee|xml|js|md|html|py|php|java|ipynb|rb)$|hub
331331

332332
[allowlist]
333333
description = "Allowlisted files"
334-
files = [
335-
'''(.*?)(png|jpg|gif|tif|tiff|doc|docx|pdf|bin|xls|pyc|zip)$''',
334+
paths = [
335+
'''(.*?)(png|tif|tiff|pyc)$''',
336336
'''buildsearchers.xml''',
337-
'''^\.?gitleaks.toml$''',
338-
'''^\.?UDMSecretChecks.toml$''',
339-
'''^\.?UDMSecretChecksv8.toml$''',
340-
'''^\.?GitleaksUdmCombo.toml$''',
341-
'''gitleaks.toml''',
342337
'''UDMSecretChecks.toml''',
343338
'''UDMSecretChecksv8.toml''',
344339
'''GitleaksUdmCombo.toml''',
345340
]
346341
commits = []
347-
paths = []
348342
repos = []

‎Dockerfile

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
FROM ghcr.io/zricethezav/gitleaks:latest
1+
FROM zricethezav/gitleaks:latest
2+
# FROM ghcr.io/zricethezav/gitleaks:latest
23

34
LABEL "com.github.actions.name"="Gitleaks Scanner"
45
LABEL "com.github.actions.description"="Runs Gitleaks in your CI/CD workflow"
@@ -9,4 +10,4 @@ LABEL "repository"="https://github.com/DariuszPorowski/github-action-gitleaks"
910
COPY .gitleaks/* /.gitleaks/
1011
COPY entrypoint.sh /entrypoint.sh
1112
USER root
12-
ENTRYPOINT ["/entrypoint.sh"]
13+
ENTRYPOINT ["/entrypoint.sh"]

‎README.md

+19-18
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,30 @@
22

33
[![GitHub release (latest by date)](https://img.shields.io/github/v/release/DariuszPorowski/github-action-gitleaks)](https://github.com/DariuszPorowski/github-action-gitleaks/releases)
44

5-
This GitHub Action allows you to run [Gitleaks](https://github.com/zricethezav/gitleaks) in your CI/CD workflow.
5+
This GitHub Action allows you to run [Gitleaks](https://github.com/gitleaks/gitleaks) in your CI/CD workflow.
66

77
> NOTE: v2 of this GitHub Action supports only the latest version of Gitleaks from v8 release.
88
99
## Inputs
1010

11-
| Name | Required | Type | Default value | Description |
12-
| ------------- | -------- | ------ | -------------------------------- | -------------------------------------------------------- |
13-
| source | false | string | $GITHUB_WORKSPACE | Path to source (relative to $GITHUB_WORKSPACE) |
14-
| config | false | string | /.gitleaks/UDMSecretChecks.toml | Config file path (relative to $GITHUB_WORKSPACE) |
15-
| report_format | false | string | json | Report file format: json, csv, sarif |
16-
| no_git | false | bool | false | Treat git repos as plain directories and scan those file |
17-
| redact | false | bool | true | Redact secrets from log messages and leaks |
18-
| fail | false | bool | true | Fail if secrets founded |
19-
| verbose | false | bool | true | Show verbose output from scan |
20-
| log_level | false | string | info | Log level (debug, info, warn, error, fatal) |
11+
| Name | Required | Type | Default value | Description |
12+
|---------------|----------|--------|---------------------------------|----------------------------------------------------------------------------------|
13+
| source | false | string | $GITHUB_WORKSPACE | Path to source (relative to $GITHUB_WORKSPACE) |
14+
| config | false | string | /.gitleaks/UDMSecretChecks.toml | Config file path (relative to $GITHUB_WORKSPACE) |
15+
| baseline_path | false | string | *not set* | Path to baseline with issues that can be ignored (relative to $GITHUB_WORKSPACE) |
16+
| report_format | false | string | json | Report file format: json, csv, sarif |
17+
| no_git | false | bool | *not set* | Treat git repos as plain directories and scan those file |
18+
| redact | false | bool | true | Redact secrets from log messages and leaks |
19+
| fail | false | bool | true | Fail if secrets founded |
20+
| verbose | false | bool | true | Show verbose output from scan |
21+
| log_level | false | string | info | Log level (trace, debug, info, warn, error, fatal) |
2122

22-
> NOTE: The solution provides predefined configuration (See: [.gitleaks](https://github.com/DariuszPorowski/github-action-gitleaks/tree/main/.gitleaks) path). You can override it by yours config using relative to `$GITHUB_WORKSPACE`.
23+
> __NOTE:__ The solution provides predefined configuration (See: [.gitleaks](https://github.com/DariuszPorowski/github-action-gitleaks/tree/main/.gitleaks) path). You can override it by yours config using relative to `$GITHUB_WORKSPACE`.
2324
2425
## Outputs
2526

2627
| Name | Description |
27-
| -------- | ------------------------------------------------------ |
28+
|----------|--------------------------------------------------------|
2829
| exitcode | Success (code: 0) or failure (code: 1) value from scan |
2930
| result | Gitleaks result summary |
3031
| output | Gitleaks log output |
@@ -33,7 +34,7 @@ This GitHub Action allows you to run [Gitleaks](https://github.com/zricethezav/g
3334

3435
## Example usage
3536

36-
> **NOTE:** You must use actions/checkout before the `github-action-gitleaks` step. If you are using `actions/checkout@v3` you must specify a commit depth other than the default which is 1.
37+
> __NOTE:__ You must use actions/checkout before the `github-action-gitleaks` step. If you are using `actions/checkout@v3` you must specify a commit depth other than the default which is 1.
3738
>
3839
> Using a `fetch-depth` of '0' clones the entire history. If you want to do a more efficient clone, use '2', but that is not guaranteed to work with pull requests.
3940
@@ -62,13 +63,13 @@ This GitHub Action allows you to run [Gitleaks](https://github.com/zricethezav/g
6263
echo "report: ${{ steps.gitleaks.outputs.report }}"
6364
6465
- name: Upload Gitleaks SARIF report to code scanning service
65-
if: steps.gitleaks.outputs.exitcode == 1
66+
if: ${{ steps.gitleaks.outputs.exitcode == 1 }}
6667
uses: github/codeql-action/upload-sarif@v2
6768
with:
6869
sarif_file: ${{ steps.gitleaks.outputs.report }}
6970
```
7071
71-
> **NOTE:** SARIF file uploads for code scanning is not available for everyone. Read GitHub docs ([Uploading a SARIF file to GitHub](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github)) for more information.
72+
> __NOTE:__ SARIF file uploads for code scanning is not available for everyone. Read GitHub docs ([Uploading a SARIF file to GitHub](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github)) for more information.
7273
7374
### With JSON report and custom rules config
7475
@@ -82,7 +83,7 @@ This GitHub Action allows you to run [Gitleaks](https://github.com/zricethezav/g
8283
id: gitleaks
8384
uses: DariuszPorowski/github-action-gitleaks@v2
8485
with:
85-
config: "MyGitleaksConfigs/MyGitleaksConfig.toml"
86+
config: MyGitleaksConfigs/MyGitleaksConfig.toml
8687

8788
- name: Upload Gitleaks JSON report to artifacts
8889
uses: actions/upload-artifact@v3
@@ -100,7 +101,7 @@ This GitHub Action allows you to run [Gitleaks](https://github.com/zricethezav/g
100101
101102
## Contributions
102103
103-
If you have any feedback on `Gitleaks`, please reach out to [Zachary Rice](https://github.com/zricethezav) for creating and maintaining [Gitleaks](https://github.com/zricethezav/gitleaks).
104+
If you have any feedback on `Gitleaks`, please reach out to [Zachary Rice (@zricethezav)](https://github.com/zricethezav) for creating and maintaining [Gitleaks](https://github.com/gitleaks/gitleaks).
104105

105106
Any feedback on the Gitleaks config for Azure `UDMSecretChecks.toml` file is welcome. Follow Jesse Houwing's GitHub repo - [gitleaks-azure](https://github.com/jessehouwing/gitleaks-azure).
106107

‎action.yml

+6-3
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,10 @@ inputs:
1616
required: false
1717
default: "json"
1818
no_git:
19-
description: "Treat git repos as plain directories and scan those file"
19+
description: "Treat git repos as plain directories and scan those file (default: <not set>)"
20+
required: false
21+
baseline_path:
22+
description: "Path to baseline with issues that can be ignored (relative to $GITHUB_WORKSPACE) (default: <not set>)"
2023
required: false
2124
redact:
2225
description: "Redact secrets from logs and stdout (default: true)"
@@ -31,7 +34,7 @@ inputs:
3134
required: false
3235
default: "true"
3336
log_level:
34-
description: "Log level (debug, info, warn, error, fatal) (default: info)"
37+
description: "Log level (trace, debug, info, warn, error, fatal) (default: info)"
3538
required: false
3639
default: "info"
3740

@@ -49,4 +52,4 @@ outputs:
4952

5053
runs:
5154
using: "docker"
52-
image: "docker://ghcr.io/dariuszporowski/github-action-gitleaks:latest"
55+
image: "Dockerfile"

0 commit comments

Comments
 (0)