Add gitleaks-scan workflow (public-repo secret scanning) - #17
Merged
Conversation
Public repos cannot run the org-level gitleaks ruleset workflow (it lives in a private repo, and GitHub refuses to require a workflow from a less visible repository), so public repos carry this copy instead, using the upstream gitleaks/gitleaks-action v3 (SHA-pinned) with the public-repo license key (org secret GITLEAKS_LICENSE_PUBLIC). The gitleaks-scan job name matches the check context used org-wide. This adds scanning only - no required-check change for this repo. Secrets are not available to workflows triggered by pull requests from forks, so the check fails on external contributors' PRs (accepted trade-off; a maintainer can re-push the branch to run it licensed). Part of the DevSec Jenkins cleanup; proven on the 14 public production libraries (canaries: salemove/stats_plug#19 green run, #20 detection).
nsalong
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gitleaks secret scanning for this public repo
Part of the org-wide DevSec cleanup: public repos can't run the org-level Gitleaks Secret Scanning ruleset workflow (it lives in a private repo), so they carry their own copy — already proven on the 14 public production libraries (clean run + planted-secret detection on stats_plug).
gitleaks/gitleaks-actionv3.0.0 SHA-pinned,actions/checkoutv6 SHA-pinned, minimal explicit permissions.GITLEAKS_LICENSE_PUBLIC(access already granted to this repo).This PR runs the workflow itself — the
gitleaks-scancheck should appear below. If it doesn't, this repo has Actions disabled or a restrictive allowed-actions list (common on forks) and needs a repo-settings fix first.