Create icon.png #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Gitleaks | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| jobs: | |
| scan: | |
| name: Gitleaks Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| id: gitleaks | |
| uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| continue-on-error: true | |
| - name: Create issue if leaks found | |
| if: steps.gitleaks.outcome == 'failure' && (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| echo "Creating detailed security issue report..." | |
| TIMESTAMP=$(date -u +"%Y-%m-%d %H:%M:%S UTC") | |
| ISSUE_BODY="## 🚨 Security Alert: Potential Secrets Detected | |
| **Detection Time:** ${TIMESTAMP} | |
| **Branch:** ${GITHUB_REF#refs/heads/} | |
| **Detected by:** Gitleaks Security Scanner | |
| ### Details | |
| Gitleaks has detected one or more potential secrets or credentials in the codebase. | |
| ### Impact | |
| Exposed secrets can lead to unauthorized access, data breaches, or account compromise. | |
| ### Next Steps | |
| 1. Review the workflow logs for specific details about the detected secrets: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| 2. Revoke any exposed credentials immediately | |
| 3. Remove the secrets from the codebase | |
| 4. Consider using GitHub Secrets or environment variables instead | |
| --- | |
| *This issue was automatically generated by the Gitleaks security scanning workflow.*" | |
| gh issue create \ | |
| --repo "${{ github.repository }}" \ | |
| --title "Security Alert: Potential secrets detected in main branch" \ | |
| --body "${ISSUE_BODY}" | |
| - name: Fail if leaks were found | |
| if: steps.gitleaks.outcome == 'failure' | |
| run: exit 1 |