Add gitea secrets subcommand to list Action secrets (#369)

* Implement gitea secrets subcommand

Author: Copilot

src/pipeleak/cmd/gitea/gitea.go

@@ -3,6 +3,7 @@ package gitea
 import (
 	"github.com/CompassSecurity/pipeleak/cmd/gitea/enum"
 	"github.com/CompassSecurity/pipeleak/cmd/gitea/scan"
+	"github.com/CompassSecurity/pipeleak/cmd/gitea/secrets"
 	"github.com/CompassSecurity/pipeleak/cmd/gitea/variables"
 	"github.com/spf13/cobra"
 )
@@ -17,6 +18,7 @@ func NewGiteaRootCmd() *cobra.Command {
 
 	giteaCmd.AddCommand(enum.NewEnumCmd())
 	giteaCmd.AddCommand(scan.NewScanCmd())
+	giteaCmd.AddCommand(secrets.NewSecretsCommand())
 	giteaCmd.AddCommand(variables.NewVariablesCommand())
 
 	return giteaCmd

src/pipeleak/cmd/gitea/secrets/secrets.go

@@ -0,0 +1,37 @@
+package secrets
+
+import (
+	"github.com/CompassSecurity/pipeleak/pkg/gitea/secrets"
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+)
+
+func NewSecretsCommand() *cobra.Command {
+	var (
+		url   string
+		token string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "secrets",
+		Short: "List all Gitea Actions secrets from groups and repositories",
+		Long:  `Fetches and logs all Actions secrets from organizations and their repositories in Gitea.`,
+		Run: func(cmd *cobra.Command, args []string) {
+			config := secrets.Config{
+				URL:   url,
+				Token: token,
+			}
+
+			if err := secrets.ListAllSecrets(config); err != nil {
+				log.Fatal().Err(err).Msg("Failed to list secrets")
+			}
+		},
+	}
+
+	cmd.Flags().StringVarP(&url, "url", "u", "https://gitea.com", "Gitea server URL")
+	cmd.Flags().StringVarP(&token, "token", "t", "", "Gitea access token (required)")
+
+	_ = cmd.MarkFlagRequired("token")
+
+	return cmd
+}

src/pipeleak/cmd/gitea/secrets/secrets_test.go

@@ -0,0 +1,23 @@
+package secrets
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewSecretsCommand(t *testing.T) {
+	cmd := NewSecretsCommand()
+
+	assert.NotNil(t, cmd)
+	assert.Equal(t, "secrets", cmd.Use)
+	assert.Contains(t, cmd.Short, "Actions secrets")
+
+	urlFlag := cmd.Flags().Lookup("url")
+	assert.NotNil(t, urlFlag)
+	assert.Equal(t, "https://gitea.com", urlFlag.DefValue)
+
+	tokenFlag := cmd.Flags().Lookup("token")
+	assert.NotNil(t, tokenFlag)
+	assert.Equal(t, "", tokenFlag.DefValue)
+}

src/pipeleak/pkg/gitea/secrets/secrets.go

@@ -0,0 +1,190 @@
+package secrets
+
+import (
+	"fmt"
+
+	"code.gitea.io/sdk/gitea"
+	"github.com/rs/zerolog/log"
+)
+
+type Config struct {
+	URL   string
+	Token string
+}
+
+// clientContext holds both the SDK client and configuration
+type clientContext struct {
+	client *gitea.Client
+	token  string
+	url    string
+}
+
+func ListAllSecrets(cfg Config) error {
+	ctx, err := createClientContext(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to create Gitea client: %w", err)
+	}
+
+	// Fetch all repositories user has access to
+	repos, err := fetchAllRepositories(ctx.client)
+	if err != nil {
+		return fmt.Errorf("failed to fetch repositories: %w", err)
+	}
+
+	log.Info().Int("count", len(repos)).Msg("Found repositories")
+
+	// Fetch organization secrets
+	orgs, err := fetchOrganizations(ctx.client)
+	if err != nil {
+		return fmt.Errorf("failed to fetch organizations: %w", err)
+	}
+
+	log.Info().Int("count", len(orgs)).Msg("Found organizations")
+
+	for _, org := range orgs {
+		if err := fetchOrgSecrets(ctx.client, org.UserName); err != nil {
+			log.Warn().Err(err).Str("org", org.UserName).Msg("Failed to fetch organization secrets")
+		}
+	}
+
+	// Fetch repository secrets for all repos
+	for _, repo := range repos {
+		if err := fetchRepoSecrets(ctx.client, repo.Owner.UserName, repo.Name); err != nil {
+			log.Warn().Err(err).Str("owner", repo.Owner.UserName).Str("repo", repo.Name).Msg("Failed to fetch repository secrets")
+		}
+	}
+
+	return nil
+}
+
+func createClientContext(cfg Config) (*clientContext, error) {
+	client, err := gitea.NewClient(cfg.URL, gitea.SetToken(cfg.Token))
+	if err != nil {
+		return nil, err
+	}
+
+	return &clientContext{
+		client: client,
+		token:  cfg.Token,
+		url:    cfg.URL,
+	}, nil
+}
+
+func fetchOrganizations(client *gitea.Client) ([]*gitea.Organization, error) {
+	var allOrgs []*gitea.Organization
+	page := 1
+	pageSize := 50
+
+	for {
+		orgs, resp, err := client.ListMyOrgs(gitea.ListOrgsOptions{
+			ListOptions: gitea.ListOptions{
+				Page:     page,
+				PageSize: pageSize,
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		allOrgs = append(allOrgs, orgs...)
+
+		if resp == nil || len(orgs) < pageSize {
+			break
+		}
+		page++
+	}
+
+	return allOrgs, nil
+}
+
+func fetchAllRepositories(client *gitea.Client) ([]*gitea.Repository, error) {
+	var allRepos []*gitea.Repository
+	page := 1
+	pageSize := 50
+
+	for {
+		repos, resp, err := client.ListMyRepos(gitea.ListReposOptions{
+			ListOptions: gitea.ListOptions{
+				Page:     page,
+				PageSize: pageSize,
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		allRepos = append(allRepos, repos...)
+
+		if resp == nil || len(repos) < pageSize {
+			break
+		}
+		page++
+	}
+
+	return allRepos, nil
+}
+
+func fetchOrgSecrets(client *gitea.Client, orgName string) error {
+	page := 1
+	pageSize := 50
+
+	for {
+		secrets, resp, err := client.ListOrgActionSecret(orgName, gitea.ListOrgActionSecretOption{
+			ListOptions: gitea.ListOptions{
+				Page:     page,
+				PageSize: pageSize,
+			},
+		})
+		if err != nil {
+			return err
+		}
+
+		for _, s := range secrets {
+			log.Info().
+				Str("org", orgName).
+				Str("secret_name", s.Name).
+				Str("type", "organization").
+				Msg("Secret")
+		}
+
+		if resp == nil || len(secrets) < pageSize {
+			break
+		}
+		page++
+	}
+
+	return nil
+}
+
+func fetchRepoSecrets(client *gitea.Client, owner, repo string) error {
+	page := 1
+	pageSize := 50
+
+	for {
+		secrets, resp, err := client.ListRepoActionSecret(owner, repo, gitea.ListRepoActionSecretOption{
+			ListOptions: gitea.ListOptions{
+				Page:     page,
+				PageSize: pageSize,
+			},
+		})
+		if err != nil {
+			return err
+		}
+
+		for _, s := range secrets {
+			log.Info().
+				Str("org", owner).
+				Str("repo", repo).
+				Str("secret_name", s.Name).
+				Str("type", "repository").
+				Msg("Secret")
+		}
+
+		if resp == nil || len(secrets) < pageSize {
+			break
+		}
+		page++
+	}
+
+	return nil
+}