diff --git a/.github/workflows/secret.scan.yml b/.github/workflows/secret.scan.yml index 915377b..e08ac36 100644 --- a/.github/workflows/secret.scan.yml +++ b/.github/workflows/secret.scan.yml @@ -5,6 +5,28 @@ on: types: [opened, synchronize, reopened] jobs: - SecretScanning: - uses: chargebee/cb-secrets-scanner/.github/workflows/cb-secret-scan.yml@main - secrets: inherit \ No newline at end of file + scan: + name: Secret PR Scan + runs-on: ubuntu-latest + steps: + - name: Get the file name changed in the PR + id: pr_files + run: | + changed_files=$(curl -s -H "Authorization: token ${{ + secrets.GITHUB_TOKEN }}" \ + -H "Accept: application/vnd.github.v3+json" \ + https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files | jq -r '.[].filename') + echo "Changed files: $changed_files" + + echo "CHANGED_FILES<> $GITHUB_OUTPUT + + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: gitleaks/gitleaks-action@v2 + env: + GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false + GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + GITLEAKS_LICENSE: '${{ secrets.GITLEAKS_LICENSE }}' + GITLEAKS_ENABLE_SUMMARY: false