ci: pin gitleaks and verify the tarball (86cb43y3t) - #7
Merged
Conversation
secret-scan.yml resolved gitleaks' latest release at run time and piped the tarball straight into tar. Two problems, neither introduced by the work that noticed them. Unpinned: this is a required check, so a gitleaks release changed what the gate accepts with no commit in this repo — the failure mode the retina repos' "Pinned deliberately" ruff pins exist to avoid. It also made a red run ambiguous between a real new finding and a rules change upstream. Unverified: piping the download into tar extracts bytes nothing has checked, and `curl -sSL` without -f writes an HTTP error page into the pipe rather than failing, so tar reported the confusing error instead of curl reporting the real one. Pins 8.30.1 (current latest, so no behaviour change today), verifies the published SHA-256 before extracting, and adds --retry for the transient TLS failure seen on ops#2. Drops the releases/latest lookup, so the step no longer needs jq or a second network call. Verified locally: download + checksum + extract succeeds; a wrong checksum exits 1 and a bad version exits 22, both before the next stage runs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes ClickUp 86cb43y3t.
secret-scan.ymlresolved gitleaks' latest release at run time and piped the tarball straight intotar.Unpinned
This is a required check, so a new gitleaks release could change what the gate accepts with no commit in this repo — the same failure mode the retina repos'
# Pinned deliberatelyruff pins exist to avoid. It also made a red run ambiguous: a new finding and an upstream rules change look identical.Pinned to 8.30.1, which is the current latest (published 2026-03-21), so this is a no-op for behaviour today — it freezes where we already are rather than moving us.
Unverified
Piping the download into
tarextracts bytes nothing has checked. The pin alone fixes reproducibility, not tampering, so the tarball is now written to disk and checked against the published SHA-256 before extraction.curl -sSLalso lacked-f, so an HTTP error page was written into the pipe andtarreported a confusing error instead of curl reporting the real one. Added-f, plus--retry 3 --retry-delay 5for the transient TLS failure seen on ops#2:Dropping the
releases/latestlookup also removes thejqdependency and one network call.Verification
Run locally (this box is arm64, so the
sudo installandgitleaks versionlines were not exercised — CI runners are x64):tarrunsBoth failure paths abort rather than falling through to a green job, which was the specific thing the ticket asked to confirm.
Bumping later
Change
GITLEAKS_VERSIONandGITLEAKS_SHA256together. Each release shipsgitleaks_<VERSION>_checksums.txt.🤖 Generated with Claude Code