Create gitleaks.yml

.github/workflows/gitleaks.yml

@@ -0,0 +1,29 @@
+# @format
+
+name: Github Secrets Scanner
+
+on: [push]
+
+jobs:
+  gitleaks_scan:
+    runs-on: ubuntu-latest
+    env:
+      REPO: https://github.com/MeasureAuthoringTool/madie-qdm-service
+      REMOTE_EXCLUDES_URL: https://raw.githubusercontent.com/semanticbits/bmat-gitleaks-automation/master/madie-qdm-service/gitleaks.toml
+      GITLEAKS_VERSION: v7.6.1
+    steps:
+      - name: Execute Gitleaks
+        run: |
+          wget ${REMOTE_EXCLUDES_URL} -O gitleaks.toml
+          wget https://github.com/zricethezav/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks-linux-amd64 -O gitleaks
+          chmod +x gitleaks
+          echo ${GITHUB_SHA}
+          echo "gitleaks --repo-url=${REPO} -v --redact --commit=${GITHUB_SHA} --config-path=gitleaks.toml"
+          ./gitleaks --repo-url=${REPO} -v --redact --commit=${GITHUB_SHA} --config-path=gitleaks.toml
+      - name: Slack notification
+        if: failure()
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+        uses: Ilshidur/action-slack@master
+        with:
+          args: "Potential Secrets found in: https://github.com/{{ GITHUB_REPOSITORY }}/commit/{{ GITHUB_SHA }} Link to build with full gitleaks output: https://github.com/{{ GITHUB_REPOSITORY }}/commit/{{ GITHUB_SHA }}/checks"