Skip to content

ci: load the org Gitleaks baseline for EVM keys #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adamkoy wants to merge 5 commits into
base: main
Choose a base branch
from
Open

ci: load the org Gitleaks baseline for EVM keys #10

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
25bd4db
ci: load the org Gitleaks baseline for EVM private keys
adamkoy Sep 28, 2026
a8e1258
ci: scan the full repo history with the org Gitleaks workflow
adamkoy Sep 28, 2026
323b2bc
ci: pin the Gitleaks baseline that ignores 1Password op:// references
adamkoy Sep 29, 2026
10e423d
ci: track secret-scan@main so allow-list updates do not need a pin bump
adamkoy Sep 29, 2026
c01ede2
ci: re-run secret scan against the org baseline
adamkoy Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 6 additions & 22 deletions .github/workflows/secret-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
###############################################################################
# Secret scan — public Gitleaks action
# Secret scan
#
# https://github.com/gitleaks/gitleaks-action
# Org repos need a free GITLEAKS_LICENSE (gitleaks.io) as an Actions secret.
# Comments and SARIF upload are off so a finding is not published on a public PR.
# Calls the public org scanner on main. Allow-list updates there apply on the
# next run, with no pin bump in this repo. gitleaks git scans the full history.
###############################################################################

name: Secret scan
Expand All @@ -23,21 +22,6 @@ permissions:
jobs:
gitleaks:
name: Secret Scan (Gitleaks)
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout repository
# actions/checkout v4.3.1
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
fetch-depth: 0
persist-credentials: false

- name: Run Gitleaks
# gitleaks/gitleaks-action v3.0.0
uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
GITLEAKS_ENABLE_COMMENTS: "false"
GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
permissions:
contents: read
uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@main
Loading