Repository navigation
ci: scan for secrets, session links and local paths with gitleaks - #420
Merged
Merged
Conversation
A Privacy workflow checks tracked files, the pull request's commit messages and its title and description. Squash merges now take the pull request title and description.
CI runs only after a branch is public, so lefthook runs the same check on each commit message and before each push.
CI: one gitleaks rules file in place of the custom script. .gitleaks.toml extends gitleaks's default secret rules with private AI session links and local workstation paths. A Leaks workflow scans files, and on pull requests also the title, description and commit messages. Lefthook runs the same rules on staged changes and commit messages.
Add the privacy rules to the existing .gitleaks.toml instead of replacing it, and drop the allowlist entry for the removed Atlas checksum file.
vishr
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository is public.
.gitleaks.tomladds two rules to gitleaks's default secret rules: private AI session links and local workstation home paths. To catch something new, add a rule there.A Leaks workflow scans the files, and on pull requests also the title, description and commit messages. Editing the description reruns it. Lefthook runs the same rules on staged changes and on each commit message; run
lefthook installwith gitleaks installed.Squash merges use the pull request title and description, so branch commit messages no longer reach
main.Replaces the trivy secret scan in Gate; trivy still scans the container image.