gitleaks.yml

name: 'CI - Gitleaks'
run-name: 'Gitleaks - "${{ github.ref_name }}"'
permissions:
  contents: read
on:
  push:
    branches:
      - "main"

  pull_request:
    branches:
      - "**"

  workflow_dispatch:

jobs:
  scan:
    name: ''
    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-24.04
    defaults:
      run:
        shell: bash
    steps:

      - uses: actions/checkout@v6.0.2
        with:
          ref: ${{ github.ref }}
          repository: '${{ github.repository }}'
          fetch-depth: 0
          submodules: true

      - name: Install Gitleaks
        env:
          VERSION: 8.30.0
          PLATFORM: linux
        run: |
          wget https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_${PLATFORM}_x64.tar.gz
          tar -xf gitleaks_${VERSION}_${PLATFORM}_x64.tar.gz
          sudo mv gitleaks /usr/local/bin/

      - name: Run Gitleaks
        id: gitleaks
        run: |
          gitleaks detect --redact --report-format=json --report-path=gitleaks-report.json --exit-code=1

      - name: Summary
        if: always()
        run: |
          echo "## Gitleaks Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
      
          if [[ "${{ steps.gitleaks.outcome }}" == "success" ]]; then
            echo "- **Status**: ✅ " >> $GITHUB_STEP_SUMMARY
          else
            echo "- **Status**: ❌ " >> $GITHUB_STEP_SUMMARY
          fi
      
          echo "" >> $GITHUB_STEP_SUMMARY
      
          if [[ -f gitleaks-report.json ]]; then
            echo "### Leaks details:" >> $GITHUB_STEP_SUMMARY
            jq -r '.[] | "- File: \(.File), Rule: \(.RuleID), Description: \(.Description), Commit: \(.Commit)"' gitleaks-report.json >> $GITHUB_STEP_SUMMARY
          else
            echo "No gitleaks report found." >> $GITHUB_STEP_SUMMARY
          fi