┌─○───┐
│ │╲ │
│ │ ○ │
│ ○ ┌─┴───────────────────┐
└─░─┤ 4 github actions │
└─────────────────────┘
Gitleaks is a SAST tool for detecting and preventing hardcoded secrets like passwords, api keys, and tokens in git repos. Gitleaks is an easy-to-use, all-in-one solution for detecting secrets, past or present, in your code. Enable Gitleaks-Action in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.
6/13/2022
On June 2, 2022, we released Gitleaks Action v2. There are a boatload of improvements
in v2, but it also represents a breaking change from the prior version (v1.6.0). We haven't merged v2 to the master branch yet because we noticed that
many users of Gitleaks Action don't pin their version. If you are using zricethezav/gitleaks-action@master (or now gitleaks/gitleaks-action@master),
then as soon as we merge v2 to master, your jobs will start failing.
We are planning to complete the merge on June 20, 2022. We recommend updating your .yml files to use v2 now so you aren't scrambling to do it after your gitleaks-action jobs start failing. As an alternative, you can pin your version to v1.6.0 for now, if you aren't ready to upgrade at the moment.
For full details, see the rest of the v2 README below. Here is the quick list of changes to your .yml:
- Change the "uses" line to
- uses: gitleaks/gitleaks-action@v2 - Add an
env:section withGITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - If you are scanning repos that belong to an organization, you'll also have to acquire a GITLEAKS_LICENSE,
add the license to your GitHub Secrets, and add this line to the
env:section:GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
- Change your "uses" line to
gitleaks/gitleaks-action@v1.6.0 - Set a reminder to upgrade to v2 later.
name: gitleaks
on: [pull_request, push, workflow_dispatch]
jobs:
scan:
name: gitleaks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for Organizations, not personal accounts.You can now use workflow_dispatch events to trigger on demand gitleaks scans.
Not much more to say here. Download reports when leaks are present. Pretty useful feature.
The latest version of gitleaks (v8.8.6 at the time of writing) has better performance, more configuration options, and is more accurate than the previous major version.
Easy to understand report of a Gitleaks job. If no leaks are detected you'll see:
If leaks are detected you'll see something like:
Gitleaks-Action Version 2 does not rely on Docker build anymore.
If a leak is encountered during a pull request, gitleaks-action will comment on the line number and commit containing the secret.
GITHUB_TOKEN: This variable is automatically assigned by GitHub when any action gets kicked off. You can read more about the token here.
gitleaks-action uses this token to call a GitHub API to comment on PRs.GITLEAKS_LICENSE(required for organizations, not required for user accounts): A gitleaks-action license obtained at gitleaks.io. It should be added as an encrypted secret to the repo or to the organization.GITLEAKS_NOTIFY_USER_LIST(optional): A list of GitHub accounts that should be alerted when gitleaks-action detects a leak. An email will be sent by GitHub to the user if their GitHub notification settings permit it. The format should be comma-separated with each username prefixed with@. Ex:@octocat,@zricethezav,@gitleaks. Spaces are okay too.GITLEAKS_ENABLE_COMMENTS(optional): Boolean value that turns on or off PR commenting. Default value istrue. Set tofalseto disable comments.GITLEAKS_CONFIG(optional): Path to a gitleaks configuration file.GITLEAKS_ENABLE_UPLOAD_ARTIFACT(optional): Boolean value that turns on or off uploading a sarif artifact when gitleaks detects secrets. Defaults totrue.GITLEAKS_ENABLE_SUMMARY(optional): Boolean value to enable or disable gitleaks job summary. Defaults totrue.
If you are scanning repos that belong to an organization account, you will need to obtain a license key. You can obtain a free license key for scanning 1 repo.
If you are scanning repos that belong to a personal account, then no license key is required.
You can visit gitleaks.io to sign up for a free license key limited to 1 repo, or choose from a paid tier to enable scanning of additional repos.
You can! This GitHub Action follows a similar order of precedence
as the gitleaks CLI tool. You can use GITLEAKS_CONFIG to explicitly set a
config path or create a gitleaks.toml at the root of the repo which will be
automatically detected and used by gitleaks-action.
The only data that gitleaks-action sends to any third party is data related to license key validation (namely GITLEAKS_LICENSE, repo name, and repo owner), which is sent to the license key validation service, keygen. Your code never leaves GitHub because the scanning takes place within the GitHub Actions docker container.
Can I use gitleaks-action as a third-party tool for GitHub code scanning?
You can but it is not recommended because it gives a false sense of security. If a secret is leaked in one commit, then removed in a subsequent commit, the security alert in the GitHub Security dashboard will show as resolved, even though the secret is still visible in the commit history. To truly address the leak, you should rotate the secret (and also consider re-writing the git history to remove the leak altogether).
Enable this gitleaks-action and copy
<img alt="gitleaks badge" src="https://img.shields.io/badge/protected%20by-gitleaks-blue"> to your readme.
Since v2.0.0 of Gitleaks-Action, the license has changed from MIT to a commercial license. Prior versions to v2.0.0 of Gitleaks-Actions will remain under the MIT license.
Copyright © 2022 Gitleaks LLC - All Rights Reserved