gitguardian.yaml

---
name: GitGuardian scan

on: [push, pull_request]

jobs:
  scanning:
    name: GitGuardian scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
        with:
          fetch-depth: 0 # fetch all history so multiple commits can be scanned
      # Configure 1Password Service Account
      - name: Configure 1Password Service Account
        uses: 1Password/load-secrets-action/configure@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
        id: configure-1password
        with:
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
      # Fetch GITGUARDIAN_API_KEY from 1Password using load-secrets-action
      - name: Fetch Secrets from 1Password
        uses: 1Password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
        id: fetch-secrets
        with:
          export-env: false
        env:
          GITGUARDIAN_API_KEY: op://Infrastructure/gitguardian/credentials/token
      - name: GitGuardian scan
        uses: GitGuardian/gg-shield-action@master
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.after }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ steps.fetch-secrets.outputs.GITGUARDIAN_API_KEY}}