feat(boatstack): make insights reviewable repository artifacts #242
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret scan | |
| # Non-bypassable secret hygiene for the public repo: scans the commit range introduced by every | |
| # PR and every push to main for committed credentials (private keys, cloud/API tokens, etc.) using | |
| # a pinned gitleaks binary with the repo's .gitleaks.toml. A local `git commit --no-verify` cannot | |
| # skip this — it is the real net. This workflow is deliberately generic and self-contained. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: secret-scan-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| gitleaks: | |
| name: gitleaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Full history so the PR/push base and head commits are both present for range scanning. | |
| fetch-depth: 0 | |
| - name: Install gitleaks (pinned) | |
| run: | | |
| set -euo pipefail | |
| VERSION="8.24.0" | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ | |
| | tar -xzf - gitleaks | |
| install -m0755 gitleaks /usr/local/bin/gitleaks | |
| gitleaks version | |
| - name: Scan the introduced commit range | |
| run: | | |
| set -euo pipefail | |
| ZERO="0000000000000000000000000000000000000000" | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| RANGE="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" | |
| elif [ "${{ github.event.before }}" != "$ZERO" ] && [ -n "${{ github.event.before }}" ]; then | |
| RANGE="${{ github.event.before }}..${{ github.sha }}" | |
| else | |
| RANGE="" | |
| fi | |
| echo "scan range: ${RANGE:-<full history>}" | |
| if [ -n "$RANGE" ]; then | |
| gitleaks git --config .gitleaks.toml --redact --no-banner --log-opts="$RANGE" . | |
| else | |
| gitleaks git --config .gitleaks.toml --redact --no-banner . | |
| fi |