guard(tenancy): mechanical per-chain scan across three table tiers #14614
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| on: | |
| push: | |
| branches: [main, "release/**"] | |
| pull_request: | |
| branches: [main, "release/**"] | |
| merge_group: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| security-events: write | |
| env: | |
| # Match the version gitleaks-action@v3 installs by default. | |
| GITLEAKS_VERSION: "8.24.3" | |
| # SHA-256 of gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz from the release | |
| # checksums.txt (https://github.com/gitleaks/gitleaks/releases/tag/v8.24.3). | |
| GITLEAKS_LINUX_X64_SHA256: "9991e0b2903da4c8f6122b5c3186448b927a5da4deef1fe45271c3793f4ee29c" | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout pinned head | |
| # gitleaks/gitleaks-action@v3 does not support the merge_group event; | |
| # the scan already ran on pull_request so skipping here is safe. | |
| if: github.event_name != 'merge_group' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| # Pin the workspace to the triggering SHA so a later push cannot move | |
| # HEAD under the scanner (#097). | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - name: Install Gitleaks | |
| if: github.event_name != 'merge_group' | |
| run: | | |
| set -euo pipefail | |
| archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}" -o /tmp/gitleaks.tgz | |
| echo "${GITLEAKS_LINUX_X64_SHA256} /tmp/gitleaks.tgz" | sha256sum -c - | |
| tar -xzf /tmp/gitleaks.tgz -C /tmp gitleaks | |
| sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks | |
| gitleaks version | |
| - name: Scan for secrets (pinned event SHAs) | |
| # Do not use gitleaks-action's PR path: it re-queries the commits API and | |
| # can build a range against a newer tip that is absent from this checkout | |
| # (#097). Event payload SHAs are immutable for the run. | |
| if: github.event_name != 'merge_group' | |
| env: | |
| GITLEAKS_BIN: gitleaks | |
| GITHUB_EVENT_NAME: ${{ github.event_name }} | |
| GITLEAKS_PINNED_BASE: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| GITLEAKS_PINNED_HEAD: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: node scripts/run-gitleaks-pinned.mjs |