Replace detect-secrets by GitLeaks

.github/workflows/security-secrets.yml

@@ -1,34 +1,22 @@
-name: Secrets scanning
+name: Secrets
 on:
   workflow_dispatch:
   pull_request:
 
 jobs:
-  detect-secrets:
-    name: Detect Secrets
+  gitleaks:
+    name: GitLeaks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v3
-
-      - name: Setup Python 3
-        uses: actions/setup-python@v4
         with:
-          python-version: 3.7
-
-      - name: Install detect-secrets
-        run: pip install detect-secrets==1.4.0
-
-      - name: Scan
-        id: scan
-        run: |
-          detect-secrets scan --baseline .secrets.baseline
-          secrets=$(cat .secrets.baseline | jq -c '.results | .[] | .[] | select(.is_secret != false)' | wc -l | sed 's/^ *//g')
-          echo "$secrets secrets found"
-          echo ::set-output name=secrets:: $secrets
+          fetch-depth: 0
 
-      - name: Fail if findings found
+      - uses: gitleaks/gitleaks-action@v2
         env:
-          SECRETS: ${{ steps.scan.outputs.secrets }}
-        run: exit $SECRETS
-
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_NOTIFY_USER_LIST: "@pablosnt"
+          GITLEAKS_ENABLE_COMMENTS: true
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: true
+          GITLEAKS_ENABLE_SUMMARY: true

.gitleaksignore

@@ -0,0 +1 @@
+02af4956765bb410e805ab14db389add0b7bd2a7:.secrets.baseline:generic-api-key:112

.pre-commit-config.yaml

@@ -8,11 +8,10 @@ repos:
             types: [python]
             require_serial: true
             verbose: true
-    - repo: https://github.com/Yelp/detect-secrets
-      rev: v1.4.0
+    - repo: https://github.com/gitleaks/gitleaks
+      rev: v8.16.1
       hooks:
-          - id: detect-secrets
-            args: ["--baseline", ".secrets.baseline"]
+        - id: gitleaks
     - repo: https://github.com/PyCQA/flake8
       rev: 4.0.1
       hooks: