Wire Jumbo (lomi. Pos) into monorepo CI, audit, and docs #198
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: lomi · security · gitleaks | |
| # Cheap secret scan: every PR/push to protected branches + weekly catch-up. | |
| # Uses the OSS gitleaks binary (no GITLEAKS_LICENSE). The official | |
| # gitleaks/gitleaks-action@v2 requires a paid org license. | |
| # | |
| # Full-history scans always trip on pre-2025 seed/JWT fixtures that cannot be | |
| # scrubbed without rewriting history. Push/PR scans only the new commit range. | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 8 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| run: | | |
| set -euo pipefail | |
| curl -sSL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Resolve scan range | |
| id: range | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| BASE="${{ github.event.pull_request.base.sha }}" | |
| HEAD="${{ github.event.pull_request.head.sha }}" | |
| echo "log_opts=${BASE}..${HEAD}" >> "$GITHUB_OUTPUT" | |
| echo "mode=range" | |
| exit 0 | |
| fi | |
| if [ "${{ github.event_name }}" = "push" ]; then | |
| BEFORE="${{ github.event.before }}" | |
| # All-zero before SHA = new branch / first push | |
| if [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ]; then | |
| echo "log_opts=${BEFORE}..${{ github.sha }}" >> "$GITHUB_OUTPUT" | |
| echo "mode=range" | |
| exit 0 | |
| fi | |
| fi | |
| # schedule / workflow_dispatch / first push: last 200 commits | |
| echo "log_opts=-n 200" >> "$GITHUB_OUTPUT" | |
| echo "mode=recent" | |
| - name: Run gitleaks | |
| run: | | |
| set -euo pipefail | |
| gitleaks detect \ | |
| --source . \ | |
| --config .gitleaks.toml \ | |
| --log-opts="${{ steps.range.outputs.log_opts }}" \ | |
| --redact \ | |
| --verbose \ | |
| --exit-code 1 |