Firefly

name: FIREFLY-CHECK-GITLEAKS
on:
  push:
    branches:
      - main
      - master
  workflow_dispatch:
jobs:
  gitleaks-check:
    environment: prod
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      - name: Install Gitleaks
        run: |
          wget https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
          tar -xvf gitleaks_8.18.2_linux_x64.tar.gz
          chmod +x gitleaks
          sudo mv gitleaks /usr/local/bin/
      - name: Run gitleaks and capture exit code
        id: gitleaks
        run: |
          set +e
          gitleaks -c .github/gitleaks.toml detect -v --no-color > gitleaks.txt
          echo "exitcode=$?" >> $GITHUB_OUTPUT
        continue-on-error: true
      - name: generate-env
        if: steps.gitleaks.outputs.exitcode == 1
        id: generate-env
        run: |
          echo "OUTPUTLEAKS=$(awk 1 ORS='\\n' gitleaks.txt)" >> $GITHUB_ENV
      - name: Send to Slack if sensitive data found
        if: steps.gitleaks.outputs.exitcode == 1
        id: slack-send
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_ICON: https://avatars.slack-edge.com/2022-03-12/3228412958213_797a01c4347dd0e18e8f_102.png
          SLACK_COLOR: ${{ steps.gitleaks.outputs.exitcode == 1 && 'failure' || 'success'}}
          SLACK_FOOTER: "Firefly's gitleaks github action check"
          SLACK_CUSTOM_PAYLOAD: '{"text": "*Author: _${{ github.actor}}_*\n\n*Ref*\n${{ github.ref }}\n\n*Actions URL*\nhttps://github.com/infralight/${{ github.event.repository.name }}/actions/runs/${{ github.run_id }}\n\n*Gitleaks Detected Sensitive Data!*\n```${{ env.OUTPUTLEAKS }}```"}'
          SLACK_TITLE: 'Gitleaks Detected Sensitive Data!'
          SLACK_USERNAME: gitleakBot
          ENABLE_ESCAPES: false
          SLACK_WEBHOOK: ${{ secrets.CI_GITLEAKS_SLACK }}
          SLACK_CHANNEL: '#security'
        continue-on-error: true
      - name: Print Gitleaks when Slack step fails
        if: steps.slack-send.outputs.outcome == 'failure'
        run:
          cat gitleaks.txt
        continue-on-error: true