From 59b3d5636ce25ccc13998c18a01602eeffe0f525 Mon Sep 17 00:00:00 2001
From: Jonny Spicer <spicerjonny@gmail.com>
Date: Tue, 18 Aug 2026 20:45:11 +0000
Subject: [PATCH] ci: pin gitleaks and verify the tarball (86cb43y3t)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

secret-scan.yml resolved gitleaks' latest release at run time and piped the
tarball straight into tar. Two problems, neither introduced by the work that
noticed them.

Unpinned: this is a required check, so a gitleaks release changed what the
gate accepts with no commit in this repo — the failure mode the retina repos'
"Pinned deliberately" ruff pins exist to avoid. It also made a red run
ambiguous between a real new finding and a rules change upstream.

Unverified: piping the download into tar extracts bytes nothing has checked,
and `curl -sSL` without -f writes an HTTP error page into the pipe rather than
failing, so tar reported the confusing error instead of curl reporting the
real one.

Pins 8.30.1 (current latest, so no behaviour change today), verifies the
published SHA-256 before extracting, and adds --retry for the transient TLS
failure seen on ops#2. Drops the releases/latest lookup, so the step no longer
needs jq or a second network call.

Verified locally: download + checksum + extract succeeds; a wrong checksum
exits 1 and a bad version exits 22, both before the next stage runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/secret-scan.yml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 720cd3f..b0fee0a 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -15,14 +15,29 @@ jobs:
 
       # Installed from the release tarball rather than the marketplace action,
       # which requires a paid licence key for organization-owned repositories.
+      #
+      # Pinned deliberately, for the same reason the retina repos pin ruff: this
+      # is a required check, so resolving `releases/latest` at run time let a new
+      # gitleaks release change what the gate accepts with no commit here and no
+      # way to tell a real new finding from a rules change. Bump VERSION and
+      # SHA256 together; each release ships gitleaks_<VERSION>_checksums.txt.
+      #
+      # The tarball is written to disk and verified before extraction rather than
+      # piped straight into tar, so nothing unverified is ever unpacked. `-f`
+      # makes curl fail on an HTTP error page instead of handing tar an HTML
+      # document, and --retry covers the transient TLS failure seen on ops#2.
       - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
         run: |
           set -euo pipefail
-          TAG="$(curl -sSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r .tag_name)"
-          VERSION="${TAG#v}"
-          echo "installing gitleaks ${TAG}"
-          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/${TAG}/gitleaks_${VERSION}_linux_x64.tar.gz" \
-            | tar -xz gitleaks
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "installing gitleaks ${GITLEAKS_VERSION}"
+          curl -fsSL --retry 3 --retry-delay 5 -o "${TARBALL}" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${TARBALL}"
+          echo "${GITLEAKS_SHA256}  ${TARBALL}" | sha256sum -c -
+          tar -xzf "${TARBALL}" gitleaks
           sudo install -m 755 gitleaks /usr/local/bin/gitleaks
           gitleaks version