gitleaks.yml

name: gitleaks
on: [push]
jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
          - name: Checkout
            uses: actions/checkout@v2
          - name: Run gitleaks
            run: docker run -v ${{ github.workspace }}:/path zricethezav/gitleaks:latest detect -v --source="/path"  --redact
  run-if-failed:
    name: gen-report (if gitleaks fails)
    runs-on: ubuntu-latest
    needs: [gitleaks]
    if: always() && (needs.gitleaks.result == 'failure')
    permissions:
      security-events: write
    steps:
    - name: Checkout
      uses: actions/checkout@v2
    - name: Generate gitleaks SARIF file
      # Exit 0 so we can get the failed report results from this step.
      run:  docker run -v ${{ github.workspace }}:/path zricethezav/gitleaks:latest detect -v --source="/path"  --redact --report-format sarif --report-path="/path/result.sarif" --exit-code=0
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v2
      with:
        # Path to SARIF file relative to the root of the repository
        sarif_file: result.sarif
        # Optional category for the results
        category: secret-analysis