chore(build): add gitleaks secret scanning workflow#124
chore(build): add gitleaks secret scanning workflow#124
Conversation
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow file that implements gitleaks secret scanning. The workflow runs on pull requests and pushes to main, checking out the repository and executing the gitleaks-action with necessary credentials passed from GitHub secrets. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/gitleaks.yml (1)
13-16: Pin action references to immutable SHAs.Using
@v4and@v2leaves the workflow trusting movable tags. Pinning both actions to full commit SHAs hardens the workflow against upstream tag retargeting.Hardening example
- - uses: actions/checkout@v4 + - uses: actions/checkout@<full-length-commit-sha> with: fetch-depth: 0 - - uses: gitleaks/gitleaks-action@v2 + - uses: gitleaks/gitleaks-action@<full-length-commit-sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gitleaks.yml around lines 13 - 16, The workflow currently references movable tags "uses: actions/checkout@v4" and "uses: gitleaks/gitleaks-action@v2"; replace those with the corresponding immutable commit SHAs for the actions (e.g., actions/checkout@<full-commit-sha> and gitleaks/gitleaks-action@<full-commit-sha>) by looking up the commit SHA in each action's GitHub repo and updating the uses entries so the workflow pins to the exact commit rather than a tag.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/gitleaks.yml:
- Line 4: The Gitleaks job is failing for forked PRs because
secrets.GITLEAKS_LICENSE is unavailable; update the workflow triggered by
pull_request to guard the job (e.g., the gitleaks job) with a conditional that
detects forks (use github.event.pull_request.head.repo.fork or
github.repository_owner != github.actor) and skip running when true, or
implement a non-licensed fallback path that avoids referencing
secrets.GITLEAKS_LICENSE for forked PRs; modify the job definition that
currently runs on pull_request to check this condition before accessing
secrets.GITLEAKS_LICENSE so external PRs do not fail.
---
Nitpick comments:
In @.github/workflows/gitleaks.yml:
- Around line 13-16: The workflow currently references movable tags "uses:
actions/checkout@v4" and "uses: gitleaks/gitleaks-action@v2"; replace those with
the corresponding immutable commit SHAs for the actions (e.g.,
actions/checkout@<full-commit-sha> and
gitleaks/gitleaks-action@<full-commit-sha>) by looking up the commit SHA in each
action's GitHub repo and updating the uses entries so the workflow pins to the
exact commit rather than a tag.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 02b2f9fe-30aa-40c5-8c8f-56e02414f731
📒 Files selected for processing (1)
.github/workflows/gitleaks.yml
| name: Gitleaks | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find .github/workflows -name "gitleaks.yml" -type f | head -20Repository: questdb/py-questdb-client
Length of output: 99
🌐 Web query:
GitHub Actions secrets exposure forked pull request environment
💡 Result:
- Default behavior (safe-by-default): GitHub Actions secrets (repo/org/environment) are not passed to workflows triggered by pull requests from forks (the usual
pull_requestevent). This is specifically to prevent an attacker from exfiltrating secrets from untrusted PR code. [1] - Where exposure happens: If you use
pull_request_target, the workflow runs in the base repository context (not the fork’s), and can have access to secrets and a write-capableGITHUB_TOKENunless you lock permissions down. This is the classic “pwn request” footgun—especially if you check out / build / run the PR’s code. [2][5] - Environments don’t automatically make it safe: If a job targets an environment (via
environment:), then environment secrets can be released to that job once its protection rules are satisfied—so a misdesignedpull_request_targetworkflow + environment secrets can still lead to exfiltration. GitHub made changes (effective Dec 8, 2025) to howpull_request_targetand environment branch protection rules are evaluated to reduce edge cases that could lead to unexpected execution with environment secrets. [4] - Explicitly enabling secrets for fork PRs (high risk): There are repo/org settings (and REST API fields like
send_secrets_and_variables) that can allow secrets/variables to be available to workflows triggered by fork PRs (notably for private repos). Turning this on increases exposure risk significantly. [3]
Practical guidance: keep untrusted-code CI on pull_request (no secrets), and if you must use pull_request_target for PR metadata/labeling, never run PR head code in that job; instead, separate trusted/untrusted stages and use least-privilege permissions:. [2][5]
🏁 Script executed:
cat -n .github/workflows/gitleaks.ymlRepository: questdb/py-questdb-client
Length of output: 569
Guard this job for forked pull requests.
secrets.GITLEAKS_LICENSE is unavailable in workflows triggered from forks, causing failures for external PRs. Skip the job for forked PRs or implement a non-licensed fallback path.
Suggested fix
jobs:
gitleaks:
+ if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/gitleaks.yml at line 4, The Gitleaks job is failing for
forked PRs because secrets.GITLEAKS_LICENSE is unavailable; update the workflow
triggered by pull_request to guard the job (e.g., the gitleaks job) with a
conditional that detects forks (use github.event.pull_request.head.repo.fork or
github.repository_owner != github.actor) and skip running when true, or
implement a non-licensed fallback path that avoids referencing
secrets.GITLEAKS_LICENSE for forked PRs; modify the job definition that
currently runs on pull_request to check this condition before accessing
secrets.GITLEAKS_LICENSE so external PRs do not fail.
2 participants
Summary
gitleaks/gitleaks-action@v2withGITLEAKS_LICENSEsecretReference: questdb/questdb#6863
Summary by CodeRabbit