This action provides a simple way to run GitLeaks in your CI/CD pipeline. It can be run on Linux (ubuntu-latest), macOS (macos-latest), or Windows (windows-latest).

In addition, it supports GitLeaks v8.x (and v7.x), and uses the GitHub caching mechanism to speed up your workflow execution time!

If you are knowingly committing a test secret that GitLeaks will catch you can add a gitleaks:allow comment to that line which will instruct GitLeaks to ignore that secret. Ex:

class CustomClass:
    discord_client_secret = '8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ' #gitleaks:allow

You can ignore specific findings by creating a .gitleaksignore file at the root of your repo. In release v8.10.0 GitLeaks added a Fingerprint value to the GitLeaks report. Each leak, or finding, has a Fingerprint that uniquely identifies a secret. Add this fingerprint to the .gitleaksignore file to ignore that specific secret. See GitLeaks' .gitleaksignore for an example.

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with: {fetch-depth: 0}

      - name: Check for GitLeaks
        uses: gacts/gitleaks@v1
        #id: gitleaks
        #with:
        #  version: latest
        #  config-path: .github/.gitleaks.toml
        #  path: any/directory/path

      #- if: ${{ always() }} # reason - https://github.com/gitleaks/gitleaks/issues/782
      #  uses: github/codeql-action/upload-sarif@v2
      #  with:
      #    sarif_file: ${{ steps.gitleaks.outputs.sarif }}

Following inputs can be used as step.with keys:

In subsequent steps you will be able to use the following variables:

GitHub has a great article on this using the BFG Repo Cleaner.

• Official GitHub action (license key is required)

To release a new version:

• Build the action distribution (make build or npm run build).
• Commit and push changes (including dist directory changes - this is important) to the master|main branch.
• Publish the new release using the repo releases page (the git tag should follow the vX.Y.Z format).

Major and minor git tags (v1 and v1.2 if you publish a v1.2.Z release) will be updated automatically.

If you find any errors in the action, please create an issue in this repository.

This is open-source software licensed under the MIT License.