ci: bump actions/upload-artifact from 4 to 7 #9

	name: gitleaks

	# Scans the repository for accidentally committed secrets (keys, tokens) using
	# the open-source gitleaks BINARY directly.
	#
	# Why not gitleaks/gitleaks-action? That action requires a paid GITLEAKS_LICENSE
	# for organization-owned repositories (public or private). The gitleaks CLI
	# itself is MIT-licensed and free, so we run it directly.
	#
	# Currently advisory (--exit-code 0): findings are uploaded to the Security >
	# Code scanning tab but do not fail the build. Flip to --exit-code 1 to gate.

	on:
	push:
	branches: [ master ]
	pull_request:
	schedule:
	- cron: '23 5 * * 1' # Mondays 05:23 UTC

	permissions:
	contents: read

	jobs:
	scan:
	name: Secret scan
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write # upload SARIF to code scanning
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0 # full history

	- name: Install gitleaks
	run: \|
	set -euo pipefail
	TAG=$(curl -sSfL https://api.github.com/repos/gitleaks/gitleaks/releases/latest \| jq -r .tag_name)
	NUM=${TAG#v}
	curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/${TAG}/gitleaks_${NUM}_linux_x64.tar.gz" -o gitleaks.tar.gz
	tar -xzf gitleaks.tar.gz gitleaks
	sudo install gitleaks /usr/local/bin/gitleaks
	gitleaks version

	- name: Run gitleaks (advisory)
	run: \|
	gitleaks dir . \
	--no-banner \
	--redact \
	--report-format sarif \
	--report-path gitleaks.sarif \
	--exit-code 0

	- name: Upload results to code scanning
	if: always()
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: gitleaks.sarif

Navigation Menu