gitleaks.yml

name: Gitleaks

on:
  workflow_call:
    inputs:
      disable-sudo:
        type: boolean
        default: true
      egress-policy-allowlist:
        type: string
        default: ''
      gitleaks-version:
        type: string
        default: 'latest'
      runs-on:
        type: string
        default: 'ubuntu-latest'

jobs:
  gitleaks:
    permissions:
      contents: read
      pull-requests: write
    name: gitleaks
    runs-on: ${{ inputs.runs-on }}
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          disable-sudo-and-containers: ${{ inputs.disable-sudo }}
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            ${{ inputs.egress-policy-allowlist }}
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: gitleaks
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        # Comments works only when the workflow is called on `pull_request:`
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
          GITLEAKS_VERSION: ${{ inputs.gitleaks-version }}