From 1657b9e9bce9df9e465cbb32e4faa856b0513f65 Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Wed, 26 Aug 2026 13:53:32 +0530 Subject: [PATCH 1/3] ci: enable Gitleaks scan in daily build Wire the existing .github/actions/analysis/gitleaks composite action into the Daily Build workflow so secrets scanning runs alongside the other static analysis steps. --- .github/workflows/daily_build.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml index 886f5aa..315c5a4 100644 --- a/.github/workflows/daily_build.yml +++ b/.github/workflows/daily_build.yml @@ -68,6 +68,11 @@ jobs: - name: checksec Analysis uses: ./.github/actions/analysis/checksec + - name: Gitleaks Scan + uses: ./.github/actions/analysis/gitleaks + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + - name: Upload daily build reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() From c60ac5b8d1dc496ad2edb571e075fd22978a0394 Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Wed, 26 Aug 2026 14:01:29 +0530 Subject: [PATCH 2/3] ci: enable Gitleaks scan in pull request workflow --- .github/workflows/pull_request.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 57b8e6f..194764c 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -63,6 +63,11 @@ jobs: - name: cppcheck uses: ./.github/actions/analysis/cppcheck + - name: Gitleaks Scan + uses: ./.github/actions/analysis/gitleaks + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + - name: Upload PR reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() From b16a75d7294c2c7946b45f48acd56c064f63bfba Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Thu, 27 Aug 2026 10:02:33 +0530 Subject: [PATCH 3/3] ci: use Gitleaks CLI binary instead of marketplace action Download a pinned, checksum-verified Gitleaks release binary into /usr/local/bin and run both 'gitleaks git -v' (commit history) and 'gitleaks dir . -v' (working tree). This removes the dependency on gitleaks-action, which requires a GITLEAKS_LICENSE for org-owned repos, and fixes the previous history-scan step that called a gitleaks binary that was never installed on the runner. Scan output is written as plain text logs under reports/; no CSV or SARIF is generated. --- .github/actions/analysis/gitleaks/action.yml | 72 ++++++++++++++------ .github/workflows/daily_build.yml | 2 - .github/workflows/pull_request.yml | 2 - 3 files changed, 51 insertions(+), 25 deletions(-) diff --git a/.github/actions/analysis/gitleaks/action.yml b/.github/actions/analysis/gitleaks/action.yml index c408063..c917526 100644 --- a/.github/actions/analysis/gitleaks/action.yml +++ b/.github/actions/analysis/gitleaks/action.yml @@ -4,43 +4,73 @@ # SPDX-License-Identifier: BSD-3-Clause # name: 'Gitleaks Scan' -description: 'Scan repository for secrets and credentials using Gitleaks' +description: 'Scan git history and the working tree for secrets using the Gitleaks CLI' inputs: - github-token: - description: 'GitHub token for Gitleaks API access' - required: true + version: + description: 'Gitleaks release version to install (without the leading v)' + required: false + default: '8.30.1' runs: using: composite steps: - - name: Run Gitleaks - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 + - name: Install Gitleaks + shell: bash env: - GITHUB_TOKEN: ${{ inputs.github-token }} + GITLEAKS_VERSION: ${{ inputs.version }} + run: | + set -euo pipefail + TMP_DIR="$(mktemp -d)" + pushd "$TMP_DIR" > /dev/null + + ARCHIVE="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" + CHECKSUMS="gitleaks_${GITLEAKS_VERSION}_checksums.txt" + BASE_URL="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" + + echo "Downloading Gitleaks ${GITLEAKS_VERSION}" + curl -sSfL --retry 3 -o "$ARCHIVE" "${BASE_URL}/${ARCHIVE}" + curl -sSfL --retry 3 -o "$CHECKSUMS" "${BASE_URL}/${CHECKSUMS}" + + echo "Verifying checksum" + grep " ${ARCHIVE}\$" "$CHECKSUMS" | sha256sum -c - + + tar -xzf "$ARCHIVE" gitleaks + sudo install -m 0755 gitleaks /usr/local/bin/gitleaks + + popd > /dev/null + rm -rf "$TMP_DIR" + + gitleaks version - name: Gitleaks git history scan - if: always() shell: bash run: | + set -uo pipefail REPORT_DIR="$GITHUB_WORKSPACE/reports" mkdir -p "$REPORT_DIR" echo "===== Gitleaks Git History Scan =====" - gitleaks git \ - --report-format sarif \ - --report-path "$REPORT_DIR/gitleaks-git-report.sarif" \ - . 2>&1 | tee "$REPORT_DIR/gitleaks-git-scan.txt" || true - echo "Gitleaks git history scan complete." - - - name: Copy report to reports directory - if: always() + gitleaks git -v 2>&1 | tee "$REPORT_DIR/gitleaks-git-scan.txt" + echo "GITLEAKS_GIT_RC=${PIPESTATUS[0]}" >> "$GITHUB_ENV" + + - name: Gitleaks directory scan shell: bash run: | + set -uo pipefail REPORT_DIR="$GITHUB_WORKSPACE/reports" mkdir -p "$REPORT_DIR" - if [ -f "$GITHUB_WORKSPACE/results.sarif" ]; then - cp "$GITHUB_WORKSPACE/results.sarif" "$REPORT_DIR/gitleaks-report.sarif" - echo "Gitleaks SARIF written to $REPORT_DIR/gitleaks-report.sarif" - else - echo "No Gitleaks SARIF output found" + echo "===== Gitleaks Directory Scan =====" + gitleaks dir . -v 2>&1 | tee "$REPORT_DIR/gitleaks-dir-scan.txt" + echo "GITLEAKS_DIR_RC=${PIPESTATUS[0]}" >> "$GITHUB_ENV" + + - name: Evaluate Gitleaks result + shell: bash + run: | + set -euo pipefail + echo "git history scan exit code: $GITLEAKS_GIT_RC" + echo "directory scan exit code: $GITLEAKS_DIR_RC" + if [ "$GITLEAKS_GIT_RC" -ne 0 ] || [ "$GITLEAKS_DIR_RC" -ne 0 ]; then + echo "::error::Gitleaks detected potential secrets. See reports/gitleaks-*-scan.txt" + exit 1 fi + echo "No leaks detected." diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml index 315c5a4..4f63cdf 100644 --- a/.github/workflows/daily_build.yml +++ b/.github/workflows/daily_build.yml @@ -70,8 +70,6 @@ jobs: - name: Gitleaks Scan uses: ./.github/actions/analysis/gitleaks - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - name: Upload daily build reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 194764c..ff5238c 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -65,8 +65,6 @@ jobs: - name: Gitleaks Scan uses: ./.github/actions/analysis/gitleaks - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - name: Upload PR reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1