secret-detection.yml

name: Gitleaks Manual

on:
  push:
    branches: [ "master", "main" ]
  pull_request:
    branches: [ "master", "main" ]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Check out the source code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download gitleaks
        run: |
          curl -LO https://github.com/zricethezav/gitleaks/releases/download/v8.15.2/gitleaks_8.15.2_linux_x64.tar.gz
          tar zxvf gitleaks_8.15.2_linux_x64.tar.gz
          chmod +x gitleaks
      - name: Scan with gitleaks
        run: ./gitleaks detect --exit-code 0 --redact --report-format sarif --report-path gitleaks-results.sarif

      # Disabled this until repo is switched to be public
      # - name: Upload SARIF file
      #   uses: github/codeql-action/upload-sarif@v2
      #   with:
      #     # Path to SARIF file relative to the root of the repository
      #     sarif_file: gitleaks-results.sarif
      #     category: GitLeaks Secret Scanning

      - name: Clean up results file
        run: rm -f gitleaks-results.sarif