hodetech/Leakwatch Secret Scanner
Detect, verify & report leaked secrets (API keys, tokens, credentials) in code, Git history, and container images.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-type | What to scan: fs (filesystem), git (repository history), or image (container image). | no | fs |
| path | Path to scan (for fs/git) or image reference (for image). | no | . |
| format | Output format: sarif, json, csv, table, or github (inline pull-request annotations). | no | sarif |
| output | Write formatted output to this file (relative to working-directory). Ignored for format=github. When empty and format=sarif, defaults to results.sarif. | no | "" |
| only-verified | Report only findings confirmed active by live verification. | no | false |
| no-verify | Disable live verification (no outbound calls to provider APIs). Recommended in CI. | no | true |
| min-severity | Minimum severity to report: low, medium, high, or critical. | no | low |
| remediation | Include remediation guidance in the output. | no | false |
| config | Path to a .leakwatch.yaml configuration file. | no | "" |
| scan-diff | For git scans, scan only commits new to the event instead of full history. "auto" enables this on pull_request/push events, "true" forces it, "false" always scans full history. Requires a checkout with fetch-depth: 0. | no | auto |
| extra-args | Additional raw arguments appended to the leakwatch scan command (space-separated). | no | "" |
| working-directory | Directory to run the scan from. | no | . |
| sarif-upload | Upload SARIF results to GitHub Code Scanning. Requires format=sarif and permissions: security-events: write. | no | false |
| fail-on-findings | Fail the workflow step when leakwatch reports findings (exit code 1). When "false", a ::warning:: is emitted instead so the scan does not block the pipeline. Hard errors (exit code >= 2) always fail the step regardless of this setting. | no | true |
| version | Leakwatch version to install: "latest" or a release tag such as v1.5.0. | no | latest |
| release-repo | GitHub repository (owner/name) to download the release binary from. Defaults to the canonical Leakwatch repo; override only for forks or self-hosted mirrors. | no | HodeTech/Leakwatch |
Outputs
| name | description |
|---|---|
| findings-count | Whether secrets were reported: 1 if any finding was reported, else 0 (mirrors the leakwatch exit code; not a count). |
| sarif-file | Path to the SARIF output file relative to the repository root (set when format=sarif). |