Skip to content

fix(security): scope gitleaks sweep to the mainline via --log-opts=HEAD (#721) #728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scottschreckengaust merged 1 commit into from
Aug 6, 2026
Merged

fix(security): scope gitleaks sweep to the mainline via --log-opts=HEAD (#721) #728

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 21 additions & 4 deletions mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,11 +126,28 @@ run = [
##################

[tasks."security:secrets"]
description = "Scan all git history for secrets with gitleaks (full-history sweep)"
description = "Scan the checked-out history for secrets with gitleaks (scheduled sweep + pre-push)"
# `gitleaks git` (history-aware) replaces the deprecated `gitleaks detect`
# (removed from --help in v8.19.0). With no --log-opts this scans the full
# history reachable from the checkout, matching the previous behaviour.
run = "gitleaks git . --no-banner --redact"
# (removed from --help in v8.19.0).
#
# Scoped to `HEAD` rather than left bare (#721, decision ratified in #723).
# Bare `gitleaks git .` walks EVERY fetched ref, so a secret in an unmerged,
# no-PR branch reddens this scan for everyone — it trains reviewers to ignore a
# red security gate, which is the worst outcome for one.
#
# `HEAD` is deliberate, and is NOT interchangeable with `main` here. HEAD is
# relative: in the scheduled CI run it resolves to `main`, but on pre-push in a
# feature worktree it also covers the commits being pushed. Pinning this to
# `main` would skip the developer's own commits — the pre-push hook would stop
# catching the secret you are about to publish.
#
# Do NOT "scope" this with a ref pattern like `--remotes=origin/main`: that
# matches no ref in a plain worktree, walks 0 commits, and silently turns the
# scan into a fail-OPEN no-op.
#
# Secrets introduced by a PR are independently caught at merge time by the
# required range-scoped check (`security:secrets:range`, see security-pr.yml).
run = 'gitleaks git . --no-banner --redact --log-opts="HEAD"'
Comment thread
scottschreckengaust marked this conversation as resolved.

[tasks."security:secrets:range"]
description = "gitleaks over a commit range only (per-PR gate). Set GITLEAKS_RANGE, e.g. origin/main..HEAD"
Expand Down
Loading