Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GitHub Action does not apply gitleaks.toml rules #131

Open
pylapp opened this issue Jan 23, 2024 · 0 comments
Open

GitHub Action does not apply gitleaks.toml rules #131

pylapp opened this issue Jan 23, 2024 · 0 comments

Comments

@pylapp
Copy link

pylapp commented Jan 23, 2024

Given the following gitleaks-action file placed in .github/workflows on my GitHub project

name: gitleaks
on: [pull_request, push, workflow_dispatch]
jobs:
  scan:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}

The GitHub action does not find my gitleaks.toml file placed at the root of the project even if this page says it will.

Defined the gitleaks.toml file elsewhere and precising through GITLEAKS_CONFIG env variable where to find it, the GitHub action just ignores it.

gitleaks.toml is like bellow:

[[rules]]
  description = "Detect Some Service key in URL"
  regex = '''(?i)apikey=([a-zA-Z0-9_-]{10})'''

and is working with gitleaks in CLI.

How make the GitHub Actions use the rules of the TOML file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant