static-analysis.yml

name: Static analysis

on: push

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Scan for secrets with gitleaks
        uses: zricethezav/gitleaks-action@master


  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v1
        with:
          python-version: 3.7

      - name: Install dependencies
        run: |
          python -m pip install trufflehog

      - name: Scan for secrets with trufflehog
        run: |
          git fetch origin +refs/tags/*:refs/tags/*
          export LAST_TAG_HASH=$(git rev-list -1 $(git describe --abbrev=0))
          trufflehog --regex --entropy True --since_commit "${LAST_TAG_HASH}" \
              --exclude_paths .trufflehog.txt file://"${PWD}"