feat(ci): add gitleaks PR-gating + base toml (Phase 0.B1-fleet Wave 2)#3
Merged
cloudingenium-automation[bot] merged 4 commits intoApr 27, 2026
Merged
Conversation
Adds a Secret Scan workflow that runs gitleaks against every PR and push to default branch. Mirrors the canonical pattern in BfxLendingBot, BfxPingPongBot, and the Wave-1 repos (BotEventAggregator, Knowledge-Hub, DigiConta, blazor-shared, infra-iac). This is Wave 2 of the Phase 0.B1-fleet rollout — the 6 repos that didn't yet have a `gitleaks.toml`. CI-style scan (`--log-opts="--no-merges -1"`) on current HEAD reports `no leaks found` against gitleaks default rules, so the toml ships as a minimal scaffold (extend `paths` / add `regexes` if findings surface). Phase 0 of the Restart-2026-04 master plan requires zero secret-leak findings across all fleet repos before the bot fleet restarts on Opus 4.7. Pre-PR gating catches hardcoded secrets before they merge to master/main. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
There was a problem hiding this comment.
Pull request overview
Adds repository-level secret scanning to gate pull requests and default-branch pushes using Gitleaks, with a minimal baseline configuration that extends the default rule set.
Changes:
- Added a base
gitleaks.tomlthat enables default rules and introduces a small global allowlist. - Added a GitHub Actions workflow to run Gitleaks on PRs, pushes to
master/main, and manual dispatch.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
gitleaks.toml |
Introduces a minimal Gitleaks config extending default rules with a repo-specific allowlist. |
.github/workflows/secret-scan.yml |
Adds CI PR-gating and default-branch secret scanning using Gitleaks. |
|
|
||
| - name: Gitleaks — secret scanning | ||
| run: | | ||
| GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name | cut -d '"' -f4 | sed 's/^v//') |
Comment on lines
+37
to
+39
| GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name | cut -d '"' -f4 | sed 's/^v//') | ||
| mkdir -p "$HOME/.local/bin" | ||
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C "$HOME/.local/bin" gitleaks |
| GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name | cut -d '"' -f4 | sed 's/^v//') | ||
| mkdir -p "$HOME/.local/bin" | ||
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C "$HOME/.local/bin" gitleaks | ||
| "$HOME/.local/bin/gitleaks" detect --source . --config gitleaks.toml --log-opts="--no-merges -1" --verbose --redact --no-banner |
Comment on lines
+16
to
+18
| '''\.gitleaksignore''', | ||
| '''\.env\.example''', | ||
| '''\.env\.local''', |
Addresses Copilot's 3 template-level concerns on Wave 2 PRs: - Pin gitleaks to 8.30.1 + verify SHA256 (no latest-release scraping) - Scan full PR commit range on pull_request (was: --log-opts -1, missed earlier commits) - fetch-depth: 0 so the base..head range resolves
…view) - Anchor paths so '.env.example.bak' and 'docs/.env.example.md' aren't allowlisted. - Remove .env.local — a real one with real secrets MUST trip the scan. Use .env.example for committed samples.
Org ruleset enforces "all actions must be pinned to a full-length commit SHA". - actions/checkout@v4 → @de0fac2e... (v6.0.2) - wagoid/commitlint-github-action@v6 → @b948419d... (v6.2.1) Surfaced as a workflow setup error blocking the gitleaks Wave 2 PR; same fix should be applied fleet-wide to any other repo whose commitlint.yml still carries unpinned tags.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 0.B1-fleet Wave 2 — adds gitleaks PR-gating + base
gitleaks.tomlto this repo.What changed
gitleaks.toml— new file (minimal scaffold:useDefault = true+ standard ignores).github/workflows/secret-scan.yml— new workflowTest plan
no leaks found🤖 Generated with Claude Code