Skip to content

Add secret scanning workflow with Gitleaks #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
crypto-titan wants to merge 1 commit into from
Closed

Add secret scanning workflow with Gitleaks #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions .github/workflows/security.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
name: enforce-secret-scanning

on:
pull_request:
push:
branches: [main]

permissions:
contents: read

env:
GITLEAKS_VERSION: "8.30.1"
GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"

jobs:
secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@aikido-pr-checks aikido-pr-checks Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GitHub Action actions/checkout persist Git credentials in workflow - low severity
actions/checkout v2 and above persist the default GITHUB_TOKEN in the repository's local git config when persist-credentials is not set to false, during the workflow run. Subsequent workflow steps or third-party actions can read this token from git configuration, increasing the risk of credential theft or misuse within the pipeline. In order to limit the attack surface when external actions are compromised, ensure persist-credentials is set to false.

Show fix

Remediation: Set persist-credentials: false on actions/checkout steps that do not need to push commits back to the repository. Only keep persist-credentials: true when the workflow explicitly performs authenticated git push operations.

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

with:
fetch-depth: 0

- name: Install gitleaks (checksum-verified)
run: |
curl -sSL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
echo "${GITLEAKS_SHA256} gitleaks.tar.gz" | sha256sum --check
tar -xzf gitleaks.tar.gz gitleaks
sudo mv gitleaks /usr/local/bin/

- name: Scan repo history
run: gitleaks git . --verbose

enforcement-canary:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Install gitleaks (checksum-verified)
run: |
curl -sSL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
echo "${GITLEAKS_SHA256} gitleaks.tar.gz" | sha256sum --check
tar -xzf gitleaks.tar.gz gitleaks
sudo mv gitleaks /usr/local/bin/

- name: Planted secret MUST be caught
run: |
echo 'const key = "AKIAQQQQQQQQQQQQQQQQ"' > canary.ts
if gitleaks dir .; then
echo "::error::gitleaks passed a planted AWS key - scanning is broken"
exit 1
fi
echo "Planted secret correctly rejected"
Loading