elizaos--eliza/.github/workflows/gitleaks.yml

name: gitleaks

# SOC2 CC7.1 — automated secret scanning on every PR and push to protected
# branches. Fails the run on any finding. Configuration: .gitleaks.toml at
# repo root.

on:
  pull_request:
    branches: ["main", "develop"]
  push:
    branches: ["main", "develop"]

# cancel superseded in-flight runs for the same PR to free hosted-runner
# capacity. only cancels pull_request runs; push runs on protected branches
# (main/develop) are never cancelled mid-flight.
# CI fan-out fix: the PR-scoped concurrency from #14069 fell back to
# github.run_id on push, so every develop push got a unique group and
# nothing ever superseded. A 37-merge wave queued thousands of push runs
# and starved the self-hosted fleet. Fall back to github.ref (all develop
# pushes share a group) and cancel superseded runs on push too. PR behavior
# is unchanged (pull_request.number still wins the key); merge_group and
# schedule events are not in the cancel set, so the merge queue and nightly
# runs always complete.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

permissions:
  contents: read

jobs:
  gitleaks:
    name: gitleaks
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    steps:
      - name: Checkout
        # actions/checkout@v4
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          # Full history so gitleaks can scan the diff range on PRs.
          fetch-depth: 0

      - name: Install gitleaks (OSS binary — no license required)
        # gitleaks/gitleaks-action@v2 requires a paid license for org repos.
        # We download the OSS CLI directly so the scan remains free and
        # honors our .gitleaks.toml allowlist + custom rules.
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.30.1
          curl -sSL -o /tmp/gitleaks.tar.gz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
          # Install without sudo so this works on any runner (github-hosted or
          # self-hosted, which has no passwordless sudo): write to a user-writable
          # dir and add it to PATH for the run step, not `sudo install /usr/local/bin`.
          mkdir -p "$HOME/.local/bin"
          install -m 0755 /tmp/gitleaks "$HOME/.local/bin/gitleaks"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          "$HOME/.local/bin/gitleaks" version

      - name: Run gitleaks
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          BEFORE_SHA: ${{ github.event.before }}
          CURRENT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          RANGE_ARGS=()
          if [[ "$EVENT_NAME" == "pull_request" ]]; then
            RANGE_ARGS=(--log-opts "${PR_BASE_SHA}..${PR_HEAD_SHA}")
          elif [[ -n "$BEFORE_SHA" && "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ]]; then
            RANGE_ARGS=(--log-opts "${BEFORE_SHA}..${CURRENT_SHA}")
          elif ! git rev-parse -q --verify "${CURRENT_SHA}^" >/dev/null 2>&1; then
            # Orphan/root tip commit: a squashed "clean baseline" release cut with
            # no parent (the release process resets main/develop to a fresh root
            # commit). `-1 <sha>` would diff it against the empty tree and re-flag
            # every token-like string in the entire monorepo — generated docs
            # dumps, benchmark fixtures, public chain addresses — the same
            # full-history re-scan the tip-commit branch below exists to avoid, in
            # its degenerate form. The baseline's content is a squash of develop
            # commits each already scanned incrementally on their PR/push, so a
            # full re-scan adds no coverage and only produces false-positive noise.
            echo "gitleaks: tip ${CURRENT_SHA} is an orphan/root baseline commit (no parent);"
            echo "its content was already scanned incrementally on develop. Skipping full-tree re-scan."
            exit 0
          else
            # Push with no usable before-SHA (force-push, branch (re)creation, or
            # an unknown range — common on main when it is reset/force-pushed).
            # Scan only the tip commit, NOT the whole history: a full-history
            # scan re-flags long-known historical artifacts (e.g. token-like
            # strings inside vendored *.patch blobs) on every such push and costs
            # ~8 min / 3 GB. New content still gets scanned via the PR range and
            # this tip-commit scan; history is audited by the scheduled deep scan.
            RANGE_ARGS=(--log-opts "-1 ${CURRENT_SHA}")
          fi

          gitleaks detect \
            --config .gitleaks.toml \
            --source . \
            --verbose \
            --redact \
            --report-format sarif \
            --report-path gitleaks.sarif \
            --no-banner \
            "${RANGE_ARGS[@]}"

      - name: Upload SARIF
        if: always()
        # actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: gitleaks-sarif
          path: gitleaks.sarif
          if-no-files-found: ignore
          retention-days: 7