dortort/Betterleaks Action
Scan for secrets and credentials using Betterleaks
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Betterleaks version (e.g., v1.1.1 or latest) | no | latest |
| scan-mode | Scan mode: git, dir, stdin, or auto (auto detects from event type) | no | auto |
| scan-path | Path to scan (positional argument to betterleaks CLI) | no | . |
| config | Path to Betterleaks config file | no | "" |
| baseline-path | Path to baseline file for incremental adoption | no | "" |
| report-format | Report format (single value): json, csv, junit, sarif, or template | no | sarif |
| report-path | Path to write the report file | no | betterleaks-report.sarif |
| redact | Redact secrets from output | no | true |
| exit-code | Custom exit code when leaks are found | no | "" |
| verbose | Enable verbose output | no | false |
| no-color | Disable colored output | no | true |
| no-banner | Suppress ASCII banner | no | true |
| validation | Enable live secret validation (CLI defaults to true) | no | true |
| extra-args | Additional CLI arguments passed directly to betterleaks | no | "" |
| fail-on-leak | Fail the action if leaks are found | no | true |
| github-token | GitHub token for authenticated API calls (version resolution) | no | ${{ github.token }} |
| timeout | Scan timeout in seconds | no | 300 |
Outputs
| name | description |
|---|---|
| exit-code | Betterleaks process exit code |
| report-path | Path to the generated report file |
| sarif-path | Path to SARIF file (for use with github/codeql-action/upload-sarif) |
| leaks-found | Whether leaks were found (true/false) |
| leak-count | Number of leaks found (only available when report-format is sarif) |