feat(renovate): track the gitleaks scanner version, not just the action - #144
Merged
Conversation
gitleaks-action bundles its own scanner and hard-codes the version: `GITLEAKS_VERSION || "8.24.3"` in src/index.js, unchanged on master. So digest-pinning the action freezes the scanner with it — pinning the action is only half the pin, and no Renovate manager could see the half that matters. That is not theoretical. 8.24.3 silently ignores global `[[allowlists]]` `paths` in .gitleaks.toml, so homelab's weekly CI reported 20 already-allowlisted historical test fixtures and public WebAuthn AAGUIDs as leaks and sat red from 2026-07-06 until today. Verified against an identical clone with the identical command: 8.24.3 reports 20 findings, 8.30.1 reports none. Waiting for upstream was not an option — v3.0.0 is the latest release, its master carries nothing touching that default, and 8.30.1 predates the v3.0.0 release by two months, so the action shipped already stale. `GITLEAKS_VERSION` is the documented override, and this manager keeps a repo's pin from rotting once set. It needs to be its own manager rather than the generic workflow tool-pin one above: gitleaks tags are v-prefixed while the action requires a bare value, so the v has to come off via extractVersionTemplate, which the generic comment-driven pattern has no place for. Matches both the YAML env form (`GITLEAKS_VERSION: 8.30.1`) and the shell form, quoted or not, and the generic manager cannot double-match because it requires a preceding `# renovate:` comment. Consumers stay opt-in: a repo with no pin keeps the action's bundled default and is unaffected. Adding the pin is what enrolls it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gap
gitleaks-actionbundles its own scanner and hard-codes the version —GITLEAKS_VERSION || "8.24.3"insrc/index.js, unchanged on master. So digest-pinning the action freezes the scanner with it: pinning the action is only half the pin, and no Renovate manager could see the half that matters.Not theoretical. 8.24.3 silently ignores global
[[allowlists]]pathsin.gitleaks.toml, so homelab's weekly CI reported 20 already-allowlisted historical test fixtures and public WebAuthn AAGUIDs as leaks and sat red from 2026-07-06 until today (cplieger/homelab#3262).Verified against an identical clone with the identical command:
no leaks foundWaiting for upstream is not a plan:
v3.0.0is the latest action release, itsmastercarries nothing touching that default, and gitleaks 8.30.1 predates the v3.0.0 release by two months — the action shipped already stale.Why its own manager
GITLEAKS_VERSIONis the documented override, and this manager keeps a pin from rotting once set. It cannot ride the generic workflow tool-pin manager above it: gitleaks tags are v-prefixed while the action requires a bare value, so thevhas to come off viaextractVersionTemplate, which the generic comment-driven pattern has no place for.Verified
GITLEAKS_VERSION: 8.30.1,"8.30.1",'8.30.1', and the shell=form# renovate:commentrenovate-config-validatorpassesBlast radius
Consumers stay opt-in. A repo with no
GITLEAKS_VERSIONkeeps the action's bundled default and is completely unaffected; adding the pin is what enrols it. First consumer: cplieger/.kiro#413.