Firefly

name: FIREFLY-CHECK-GITLEAKS on: push: branches: - main - master workflow_dispatch: jobs: gitleaks-check: environment: prod runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v2 - name: Install Gitleaks run: | wget https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz tar -xvf gitleaks_8.18.2_linux_x64.tar.gz chmod +x gitleaks sudo mv gitleaks /usr/local/bin/ - name: Run gitleaks and capture exit code id: gitleaks run: | set +e gitleaks -c .github/gitleaks.toml detect -v --no-color > gitleaks.txt echo "exitcode=$?" >> $GITHUB_OUTPUT continue-on-error: true - name: generate-env if: steps.gitleaks.outputs.exitcode == 1 id: generate-env run: | echo "OUTPUTLEAKS=$(awk 1 ORS='\\n' gitleaks.txt)" >> $GITHUB_ENV - name: Send to Slack if sensitive data found if: steps.gitleaks.outputs.exitcode == 1 id: slack-send uses: rtCamp/action-slack-notify@v2 env: SLACK_ICON: https://avatars.slack-edge.com/2022-03-12/3228412958213_797a01c4347dd0e18e8f_102.png SLACK_COLOR: ${{ steps.gitleaks.outputs.exitcode == 1 && 'failure' || 'success'}} SLACK_FOOTER: "Firefly's gitleaks github action check" SLACK_CUSTOM_PAYLOAD: '{"text": "*Author: _${{ github.actor}}_*\n\n*Ref*\n${{ github.ref }}\n\n*Actions URL*\nhttps://github.com/infralight/${{ github.event.repository.name }}/actions/runs/${{ github.run_id }}\n\n*Gitleaks Detected Sensitive Data!*\n```${{ env.OUTPUTLEAKS }}```"}' SLACK_TITLE: 'Gitleaks Detected Sensitive Data!' SLACK_USERNAME: gitleakBot ENABLE_ESCAPES: false SLACK_WEBHOOK: ${{ secrets.CI_GITLEAKS_SLACK }} SLACK_CHANNEL: '#security' continue-on-error: true - name: Print Gitleaks when Slack step fails if: steps.slack-send.outputs.outcome == 'failure' run: cat gitleaks.txt continue-on-error: true