From 960c864d3d31c3aab747a849260dde9909f8873d Mon Sep 17 00:00:00 2001 From: "v.oleynikov" Date: Tue, 28 Jul 2026 13:18:51 +0300 Subject: [PATCH] ci(gitleaks): extend the centralized config and move the action to v16 Two changes that only make sense together. The action moves from modules-actions@v6 to @v16. v6 predates the centralized gitleaks config entirely: no gitleaks/config directory, and it greps for an undotted gitleaks.toml that this module does not ship. .gitleaks.toml now extends the centralized config instead of the gitleaks defaults. "useDefault = true" extends gitleaks own defaults, so the centralized base config never applied here and its rules -- werf-secret-key, hashicorp-vault-token, openbao-token, none of which exist in any default ruleset -- never ran. Pointing [extend] at the base config is what the header of gitleaks.base.toml documents, and v16 places that file at the repository root, so the relative path resolves. Verified with the v16 layout reproduced locally: the base rules fire, the base allowlists apply, and this module reports no findings at full scan scope. Signed-off-by: v.oleynikov --- .github/workflows/gitleaks-scan-on-pr.yml | 2 +- .github/workflows/gitleaks-scan-on-schedule.yml | 2 +- .gitleaks.toml | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/gitleaks-scan-on-pr.yml b/.github/workflows/gitleaks-scan-on-pr.yml index 8f354343..af281e4c 100644 --- a/.github/workflows/gitleaks-scan-on-pr.yml +++ b/.github/workflows/gitleaks-scan-on-pr.yml @@ -30,6 +30,6 @@ jobs: pull-requests: read steps: - name: Run Gitleaks diff scan - uses: deckhouse/modules-actions/gitleaks@v6 + uses: deckhouse/modules-actions/gitleaks@v16 with: scan_mode: "diff" diff --git a/.github/workflows/gitleaks-scan-on-schedule.yml b/.github/workflows/gitleaks-scan-on-schedule.yml index 9d70fc79..c4d230c8 100644 --- a/.github/workflows/gitleaks-scan-on-schedule.yml +++ b/.github/workflows/gitleaks-scan-on-schedule.yml @@ -32,6 +32,6 @@ jobs: pull-requests: read steps: - name: Run Gitleaks diff scan - uses: deckhouse/modules-actions/gitleaks@v6 + uses: deckhouse/modules-actions/gitleaks@v16 with: scan_mode: "full" diff --git a/.gitleaks.toml b/.gitleaks.toml index 72e3c372..c8f2a303 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -1,6 +1,7 @@ -# Use default gitleaks rules + module allowlist +# Extend the centralized Deckhouse gitleaks config + module allowlist [extend] -useDefault = true +useDefault = false +path = "gitleaks.base.toml" [allowlist] paths = [