ci: add gitleaks scanning workflow and custom rules#142
ci: add gitleaks scanning workflow and custom rules#142yaozhen00 merged 1 commit intolarksuite:mainfrom
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds a Gitleaks GitHub Actions workflow and a .gitleaks.toml config to run on pushes, pull requests to Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant PR as Pull Request / Push
participant GH as GitHub Actions
participant Runner as Actions Runner (ubuntu-latest)
participant Checkout as actions/checkout
participant Gitleaks as gitleaks/gitleaks-action
PR->>GH: push / PR to main or manual dispatch
GH->>Runner: start gitleaks job (if not forked PR)
Runner->>Checkout: checkout repo (fetch-depth: 0)
Runner->>Gitleaks: run action (env: GITHUB_TOKEN, GITLEAKS_LICENSE)
Gitleaks->>Runner: scan repository using .gitleaks.toml
Gitleaks->>GH: return findings / status
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/gitleaks.yml:
- Line 19: Replace the mutable tag reference "gitleaks/gitleaks-action@v2" with
the action pinned to a specific commit SHA; locate the workflow step that
currently references gitleaks/gitleaks-action (the string
"gitleaks/gitleaks-action@v2") and change it to the corresponding immutable
commit SHA (e.g., "gitleaks/gitleaks-action@<commit-sha>") so the CI uses a
fixed action version consistent with the checkout step pinned to a SHA.
- Around line 20-24: The Gitleaks step is failing on forked pull requests
because GITLEAKS_LICENSE (env) is unavailable for forks; update the
.github/workflows/gitleaks.yml to avoid running gitleaks for forks by adding a
conditional that detects fork PRs (e.g., check
github.event.pull_request.head.repo.full_name vs github.repository or compare
github.event.pull_request.head.repo.owner.login to github.repository_owner) and
skip the gitleaks step when they differ, or alternatively change the workflow
trigger to pull_request_target or run gitleaks from a separate workflow
(workflow_run) after PR CI completes; ensure the change references the existing
GITLEAKS_LICENSE env usage and the gitleaks-action invocation so the step no
longer runs when license secrets are inaccessible.
In @.gitleaks.toml:
- Around line 6-10: The current gitleaks rule "lark-bot-app-id" uses regex
'\bcli_[A-Za-z0-9]{6,}\b' which matches legitimate test fixtures and will block
PRs; update the rule by either tightening the regex (for example require a
longer minimum length or additional delimiter/format constraints beyond {6,}
such as '\bcli_[A-Za-z0-9]{10,}\b' or include a specific prefix/suffix pattern)
or add a rule-level allowlist to exclude test paths (e.g., exclude patterns
matching *_test.go or test directories) so the "lark-bot-app-id" rule no longer
flags existing test strings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6d2a1b35-e01b-4498-bdf7-3e8eaefcb373
📒 Files selected for processing (2)
.github/workflows/gitleaks.yml.gitleaks.toml
Greptile SummaryThis PR adds a Gitleaks secret-scanning workflow (triggered on PRs to Confidence Score: 5/5Safe to merge — no blocking issues remain; both prior review concerns have been addressed. The action is SHA-pinned, permissions are minimal (contents: read), the fork-exclusion guard is correct, fetch-depth: 0 is correct for full-history scans, and the tightened regex ([a-z0-9]{16}) generates no false positives against any test string currently in the repository. All remaining considerations are P2 or lower. No files require special attention. Important Files Changed
Sequence DiagramsequenceDiagram
participant Dev as Developer
participant GH as GitHub
participant Runner as Actions Runner
participant GL as gitleaks-action
Dev->>GH: Open PR targeting main
GH->>Runner: Trigger gitleaks workflow (pull_request event)
Runner->>Runner: Check: not a fork PR?
Runner->>Runner: actions/checkout (fetch-depth: 0)
Runner->>GL: Run gitleaks/gitleaks-action@SHA
GL->>GL: Load .gitleaks.toml (extends default ruleset)
GL->>GL: Scan all commits with lark-bot-app-id + lark-session-token rules
alt Secret found
GL->>GH: Fail check, block merge
else No secrets
GL->>GH: Pass check
end
Dev->>GH: Push to main (merge)
GH->>Runner: Trigger gitleaks workflow (push event)
Runner->>GL: Re-scan merged commits
Reviews (2): Last reviewed commit: "ci: add fork-safe gitleaks workflow" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
github-actions
bot
added
the
size/M
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@40aeec4678f42552c5cd9e7f838a9cef2c12138d🧩 Skill updatenpx skills add iyaozhen/cli#feature/ci -y -g |
3 participants
Summary
Test Plan
Summary by CodeRabbit