chore: prepare release #214
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly on Mondays at 6am UTC. Catches secrets in commits that | |
| # match a rule introduced in a newer gitleaks release after the | |
| # commit landed. | |
| - cron: '0 6 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: secret-scan-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| # In audit mode: logs unauthorized egress without blocking; promote to | |
| # `egress-policy: block` once a stable allowlist emerges from runs. | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| # Full history so gitleaks detect can scan every commit, not | |
| # just the latest tree. Same posture as our other supply-chain | |
| # scans (audit.yml, codeql.yml). | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # gitleaks-action's default scans `<before>..<after>` on push events | |
| # (only new commits) and full history only on schedule/dispatch. That | |
| # leaves up to a 7-day window where a force-push to hide an already- | |
| # committed secret could go undetected. Calling `gitleaks detect` | |
| # directly always scans full history regardless of trigger event. | |
| # Verify the tarball SHA256 against the release's checksums file — | |
| # defense against single-blob tampering of the gitleaks binary itself. | |
| - name: Install gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | |
| file="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| cd /tmp | |
| curl -sSfL "${base}/${file}" -o "${file}" | |
| curl -sSfL "${base}/gitleaks_${GITLEAKS_VERSION}_checksums.txt" -o checksums.txt | |
| # Pre-filter to our file so a malformed checksums.txt missing | |
| # this line fails loud (pipefail surfaces grep's exit 1) instead | |
| # of silently passing as `--ignore-missing` would. | |
| grep -F "${file}" checksums.txt | sha256sum --check - | |
| sudo tar -xz -C /usr/local/bin -f "${file}" gitleaks | |
| gitleaks version | |
| - name: Run gitleaks | |
| run: gitleaks detect --no-banner --source . |