Skip to content

ci: add gitleaks secret scanning - #1444

Merged
eleshar merged 5 commits into
developfrom
ci/gitleaks-secret-scanning
Jul 31, 2026
Merged

ci: add gitleaks secret scanning#1444
eleshar merged 5 commits into
developfrom
ci/gitleaks-secret-scanning

Conversation

@eleshar

@eleshareleshar commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Build/CI Pull Request

Linked issues

Closes#1445

Build/CI change

  • What: Adds gitleaks-reusable.yml (a workflow_call reusable workflow for organisation-wide use) and gitleaks.yml (this repository's caller, running on pull requests into develop/main and on workflow_dispatch). Adds .gitleaks.toml.
  • Why: No secret scanning existed. The gitleaks-action wrapper requires a paid licence for organisation repositories, so this invokes the open-source Gitleaks CLI directly — the same approach already used in lightspeed-hosting-infra.

Baseline & Target

  • Before: No secret scanning on this repository.
  • After: Every pull request scanned; workflow_dispatch accepts full-history: true for an on-demand full-history rescan.

Rollback

Revert this PR. The workflows are additive and nothing else depends on them.

Notes

  • Secrets/permissions: None required. The workflow downloads a public Gitleaks release and reads repository contents only; no stored secrets are referenced.
  • A baseline full-history scan returned 50 hits. All were verified individually as placeholder values in documentation and tests (sk_live_abc123…, a doc-labelled mock key, and Figma file-key examples matched by the generic-api-key rule). No live credentials were found and none require rotation; all are allowlisted in .gitleaks.toml.

Changelog

Added

  • Gitleaks secret scanning — reusable organisation workflow plus per-repository caller, scanning pull requests with an on-demand full-history rescan option.

Changed

  • None

Fixed

  • None

Removed

  • None

Checklist (Global DoD / PR)

  • All AC met and demonstrated
  • Tests added/updated (unit/E2E as appropriate) — CI configuration only; exercised by the workflow running on this PR
  • Accessibility checklist completed (where relevant):
    • Semantic HTML and heading order verified — no UI in scope
    • Keyboard navigation and visible focus states verified — no UI in scope
    • ARIA used only where needed — no UI in scope
    • Contrast and non-colour cues reviewed (WCAG 2.2 AA or higher) — no UI in scope
  • Docs/readme/changelog updated (if user-facing)
  • Security checklist completed (where relevant):
    • Untrusted input validated and sanitised — workflow inputs are typed booleans
    • Output escaped for its rendering context — scan output runs with --redact
    • Privileged actions enforce nonce and capability checks — no privileged actions in scope
    • No secrets/sensitive data introduced; OWASP risks reviewed
  • Code/design reviews approved
  • CI green; linked issues closed; release notes prepared (if shipping)

@github-actions

github-actionsBot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

⏱️ Aging and SLA annotation

  • Age: 0 day(s)
  • SLA state: Within SLA
  • Thresholds: warn at 7 days, breach at 14 days
  • Last updated: 2026-07-31T10:07:19.151Z

Maintained by project-meta-sync workflow.

@github-actions

github-actionsBot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

✅ Template check passed after update. Thanks for fixing the PR description.

@github-actionsgithub-actionsBot added status:needs-review Awaiting code review type:build Build & CI area:ci Build and CI pipelines type:ci CI/CD pipeline work priority:normal Default priority type:chore Chore / small hygiene change meta:needs-changelog Requires a changelog entry before merge labels Jul 31, 2026
@github-actions

github-actionsBot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

🔍 Reviewer Summary for PR #1444

CI Status:success
Files changed: 4
Risk Distribution: 2 critical, 0 high, 0 medium, 2 low

Recommendations

  • ⚠️ 2 critical-risk file(s) modified (workflows, secrets)
  • ⚠️ Security-sensitive files modified (review carefully)

@coderabbitai

coderabbitaiBot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@eleshar, you've reached your PR review limit, so we couldn't start this review.

Next review available in:41 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f4f2fa1-757f-490f-9af2-37422f87607d

📥 Commits

Reviewing files that changed from the base of the PR and between 82bd2c1 and aa0339a.

📒 Files selected for processing (3)
  • .github/workflows/gitleaks-reusable.yml
  • .github/workflows/gitleaks.yml
  • CHANGELOG.md
📝 Walkthrough

Summary by CodeRabbit

  • New Features
    • Added automated secret scanning for pull requests and manually triggered checks.
    • Added configurable full-history scanning for more thorough security reviews.
    • Added scanning rules that account for approved example secrets in specified documentation.

Walkthrough

Adds Gitleaks scanning for pull requests and manual runs. The reusable workflow supports shallow or full-history checkout, installs the latest Gitleaks release, and applies project-specific allowlists for documented example secrets.

Changes

Gitleaks scanning

Layer / File(s)Summary
Scan policy and reusable execution
.gitleaks.toml, .github/workflows/gitleaks-reusable.yml
The configuration enables default rules and allows three example patterns in two documentation paths. The reusable workflow selects checkout history, installs Gitleaks, and runs a redacted scan.
Workflow entry points
.github/workflows/gitleaks.yml
The workflow runs for pull requests and manual dispatches. Manual dispatches provide the full-history input and pass it to the reusable workflow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
participant PullRequestOrManualRun
participant GitleaksWorkflow
participant ReusableWorkflow
participant Gitleaks
PullRequestOrManualRun->>GitleaksWorkflow: trigger scan
GitleaksWorkflow->>ReusableWorkflow: pass full-history setting
ReusableWorkflow->>ReusableWorkflow: check out selected history
ReusableWorkflow->>Gitleaks: run scan with .gitleaks.toml
Gitleaks-->>ReusableWorkflow: return redacted scan result
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title clearly and concisely describes the addition of Gitleaks secret scanning to CI.
Description check✅ PassedThe description covers the change, rationale, linked issue, rollback, security notes, changelog, and checklist with sufficient detail.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Fix failing CI checks
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ci/gitleaks-secret-scanning

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
.github/workflows/gitleaks.yml (1)

3-3: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Add a boundary for pull-request runs.

Add a branches filter for the protected merge branches, or document why every base branch requires this scan. The comparable reviewer.yml workflow targets develop.

This keeps routine scan runs focused without using path filters that could exclude secrets. As per path instructions, “ensure branch/path filters are present to avoid unnecessary runs”.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/gitleaks.yml at line 3, Add a pull_request branches filter
in the gitleaks workflow, targeting the protected merge branches consistent with
the repository’s branch conventions and the reviewer.yml workflow’s develop
target. Keep the scan applicable to all relevant paths and avoid adding path
filters that could exclude secrets.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gitleaks-reusable.yml:
- Line 14: Update .github/workflows/gitleaks-reusable.yml lines 14-14 to use
truthy string values in the full-history fetch-depth pseudo-ternary, preserving
depth 0 when inputs.full-history is true and depth 1 otherwise. Update lines
19-19 with explicit conditional shell branches so full-history runs gitleaks
detect without --no-git, while the shallow path retains --no-git --source ..
---
Nitpick comments:
In @.github/workflows/gitleaks.yml:
- Line 3: Add a pull_request branches filter in the gitleaks workflow, targeting
the protected merge branches consistent with the repository’s branch conventions
and the reviewer.yml workflow’s develop target. Keep the scan applicable to all
relevant paths and avoid adding path filters that could exclude secrets.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 66b7e038-7239-4533-8bbf-917fff0df975

📥 Commits

Reviewing files that changed from the base of the PR and between 5b3b0d8 and 82bd2c1.

📒 Files selected for processing (3)
  • .github/workflows/gitleaks-reusable.yml
  • .github/workflows/gitleaks.yml
  • .gitleaks.toml
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
  • GitHub Check: Mergify Merge Protections
  • GitHub Check: Summary
⚠️ CI failures not shown inline (4)

GitHub Actions: Changelog • Management / 0_Validate changelog on PR.txt: ci: add gitleaks secret scanning

Conclusion: failure

View job details

##[group]Run actions/github-script@v7
with:
script: const cp = require("node:child_process");
const author = context.payload.pull_request?.user?.login || "";
const labels = (context.payload.pull_request?.labels || []).map((l) => l.name);
const has = (name) => labels.includes(name);
if (author === "dependabot[bot]" || author === "app/dependabot") {
core.info("Skipping changelog requirement for Dependabot pull requests.");
core.setOutput("run_validation", "false");
return;
}
if (has("meta:needs-changelog") && has("meta:no-changelog")) {
core.setFailed("PR cannot include both meta:needs-changelog and meta:no-changelog.");
return;
}
const restrictedTypes = new Set([
"type:feature",
"type:bug",
"type:performance",
"type:security",
"type:release",
"type:hotfix",
]);
if (has("meta:no-changelog") && labels.some((label) => restrictedTypes.has(label))) {
core.setFailed("meta:no-changelog is not allowed for high-impact release-related change types.");
return;
}
const baseSha = context.payload.pull_request?.base?.sha;
const headSha = context.payload.pull_request?.head?.sha;
const changed = cp
.execSync(`git diff --name-only ${baseSha} ${headSha}`, {
encoding: "utf8",
maxBuffer: 1024 * 1024 * 100,
})
.split("\n")
.filter(Boolean);
if (changed.includes("CHANGELOG.md")) {
core.info("CHANGELOG.md updated in PR diff.");
core.setOutput("run_validation", "true");
return;
}
if (has("meta:no-changelog")) {
core.info("Skipping changelog requirement due to meta:no-changelog label.");
core.setOutput("run_validation", "false");
return;
}
core.setFailed("PR requires a CHANGELOG.md update or the meta:no-changelog label.");
github-***REDACTED_SECRET_ASSIGNMENT***
debug: false
user-agent: actions/github-script
result-encoding: json
retries: 0
retry-exempt-status-codes: 400,401,403,404,422
##[endgroup]
##[error]PR requires a CHANGELOG.md update or the meta:no-changelog label.

GitHub Actions: Changelog • Management / Validate changelog on PR: ci: add gitleaks secret scanning

Conclusion: failure

View job details

##[group]Run actions/github-script@v7
with:
script: const cp = require("node:child_process");
const author = context.payload.pull_request?.user?.login || "";
const labels = (context.payload.pull_request?.labels || []).map((l) => l.name);
const has = (name) => labels.includes(name);
if (author === "dependabot[bot]" || author === "app/dependabot") {
core.info("Skipping changelog requirement for Dependabot pull requests.");
core.setOutput("run_validation", "false");
return;
}
if (has("meta:needs-changelog") && has("meta:no-changelog")) {
core.setFailed("PR cannot include both meta:needs-changelog and meta:no-changelog.");
return;
}
const restrictedTypes = new Set([
"type:feature",
"type:bug",
"type:performance",
"type:security",
"type:release",
"type:hotfix",
]);
if (has("meta:no-changelog") && labels.some((label) => restrictedTypes.has(label))) {
core.setFailed("meta:no-changelog is not allowed for high-impact release-related change types.");
return;
}
const baseSha = context.payload.pull_request?.base?.sha;
const headSha = context.payload.pull_request?.head?.sha;
const changed = cp
.execSync(`git diff --name-only ${baseSha} ${headSha}`, {
encoding: "utf8",
maxBuffer: 1024 * 1024 * 100,
})
.split("\n")
.filter(Boolean);
if (changed.includes("CHANGELOG.md")) {
core.info("CHANGELOG.md updated in PR diff.");
core.setOutput("run_validation", "true");
return;
}
if (has("meta:no-changelog")) {
core.info("Skipping changelog requirement due to meta:no-changelog label.");
core.setOutput("run_validation", "false");
return;
}
core.setFailed("PR requires a CHANGELOG.md update or the meta:no-changelog label.");
github-***REDACTED_SECRET_ASSIGNMENT***
debug: false
user-agent: actions/github-script
result-encoding: json
retries: 0
retry-exempt-status-codes: 400,401,403,404,422
##[endgroup]
##[error]PR requires a CHANGELOG.md update or the meta:no-changelog label.

GitHub Actions: Validate PR Template / 0_validate-pr-template.txt: ci: add gitleaks secret scanning

Conclusion: failure

View job details

##[group]Run actions/github-script@v7
with:
script: const { validatePullRequestBody } = require('./scripts/validation/template-helpers.cjs');
const marker = '<!-- template-enforcement -->';
const pr = context.payload.pull_request;
const author = pr.user?.login || '';
const isDependabot = author === 'dependabot[bot]' || author === 'app/dependabot';
const isImgbot = author === 'imgbot[bot]' || author === 'app/imgbot';
if (isDependabot || isImgbot) {
core.info(`Skipping PR template validation for bot author ${author}.`);
return;
}
const validation = validatePullRequestBody(pr.body || '', pr.labels || [], pr.head?.ref || '');
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
per_page: 100
});
const previous = comments.find((comment) =>
comment.user?.type === 'Bot' && comment.body?.includes(marker)
);
if (validation.missing.length === 0) {
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: `${marker}\n✅ Template check passed after update. Thanks for fixing the PR description.`
});
}
return;
}
const message = [
marker,
'🚫 This PR description is missing required template content.',
'',
`Missing required section(s): ${validation.missing.join(', ')}`,
'',
'Please update the PR body using one of the repository PR templates:',
'- https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md',
'- https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE',
'',
'Empty placeholders, unchecked checklist boxes, and stub issue references do not count.'
].join('\n');
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: message
});
} else {
await github.rest.issues....

GitHub Actions: Validate PR Template / validate-pr-template: ci: add gitleaks secret scanning

Conclusion: failure

View job details

##[group]Run actions/github-script@v7
with:
script: const { validatePullRequestBody } = require('./scripts/validation/template-helpers.cjs');
const marker = '<!-- template-enforcement -->';
const pr = context.payload.pull_request;
const author = pr.user?.login || '';
const isDependabot = author === 'dependabot[bot]' || author === 'app/dependabot';
const isImgbot = author === 'imgbot[bot]' || author === 'app/imgbot';
if (isDependabot || isImgbot) {
core.info(`Skipping PR template validation for bot author ${author}.`);
return;
}
const validation = validatePullRequestBody(pr.body || '', pr.labels || [], pr.head?.ref || '');
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
per_page: 100
});
const previous = comments.find((comment) =>
comment.user?.type === 'Bot' && comment.body?.includes(marker)
);
if (validation.missing.length === 0) {
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: `${marker}\n✅ Template check passed after update. Thanks for fixing the PR description.`
});
}
return;
}
const message = [
marker,
'🚫 This PR description is missing required template content.',
'',
`Missing required section(s): ${validation.missing.join(', ')}`,
'',
'Please update the PR body using one of the repository PR templates:',
'- https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md',
'- https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE',
'',
'Empty placeholders, unchecked checklist boxes, and stub issue references do not count.'
].join('\n');
if (previous) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: previous.id,
body: message
});
} else {
await github.rest.issues....
🧰 Additional context used
📓 Path-based instructions (1)
**/.github/workflows/*.yml

⚙️ CodeRabbit configuration file

**/.github/workflows/*.yml: Review GitHub Actions workflows for this governance repo:

  • Security: check for least-privilege permissions (use permissions: at job level, default to read-only).
  • Secret handling: ensure secrets are passed via env vars, not interpolated directly into run: steps to prevent injection.
  • Action pinning: prefer SHA-pinned actions over mutable tags (e.g. actions/checkout@v4 is acceptable; SHA pins are better).
  • No pull_request_target with untrusted code execution unless explicitly justified.
  • Avoid storing sensitive outputs as unmasked step outputs.
  • Check for reusable workflow patterns and matrix strategies where appropriate.
  • Validate on: triggers: ensure branch/path filters are present to avoid unnecessary runs.
  • Confirm workflows are documented, DRY, and maintainable.
  • Ensure agent-triggered workflows use workflow_dispatch with defined inputs.

Files:

  • .github/workflows/gitleaks.yml
  • .github/workflows/gitleaks-reusable.yml
🪛 zizmor (1.28.0)
.github/workflows/gitleaks-reusable.yml

[warning] 12-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)


[warning] 14-14: unsound pseudo-ternary expression (unsound-ternary): pseudo-ternary has falsy true value

(unsound-ternary)


[warning] 19-19: unsound pseudo-ternary expression (unsound-ternary): pseudo-ternary has falsy true value

(unsound-ternary)

🔇 Additional comments (3)
.gitleaks.toml (1)

1-16: LGTM!

.github/workflows/gitleaks-reusable.yml (1)

1-7: LGTM!

.github/workflows/gitleaks.yml (1)

4-13: LGTM!

Comment thread.github/workflows/gitleaks-reusable.yml Outdated
@github-actionsgithub-actionsBot removed type:chore Chore / small hygiene change type:ci CI/CD pipeline work labels Jul 31, 2026
@github-actionsgithub-actionsBot added area:documentation Docs & guides lang:md Markdown content/docs type:ci CI/CD pipeline work labels Jul 31, 2026
@github-actionsgithub-actionsBot removed the type:ci CI/CD pipeline work label Jul 31, 2026
@github-actionsgithub-actionsBot added the type:ci CI/CD pipeline work label Jul 31, 2026
@eleshar
eleshar merged commit 27a3677 into developJul 31, 2026
29 of 30 checks passed
@eleshar
eleshar deleted the ci/gitleaks-secret-scanning branch July 31, 2026 10:27
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:ciBuild and CI pipelinesarea:documentationDocs & guideslang:mdMarkdown content/docsmeta:needs-changelogRequires a changelog entry before mergepriority:normalDefault prioritystatus:needs-reviewAwaiting code reviewtype:buildBuild & CItype:ciCI/CD pipeline work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Gitleaks secret scanning across the organisation

1 participant

@eleshar