opensecdevops/OSDO Secrets Scan
Scan for secrets and credentials in code using Gitleaks, TruffleHog, and detect-secrets
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 21, 2026
- License
- None
Pinned Snippet
uses: opensecdevops/osdo-secrets-scan@850f532632f04234b0d49e059cc96f738f921e08 # v2.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan for secrets | no | . |
| scanners | Scanners to use (gitleaks, trufflehog, detect-secrets, all) | no | gitleaks |
| scan-mode | Scan mode (all-history, staged, pre-commit, directory) | no | directory |
| baseline-file | Path to baseline file for known secrets (detect-secrets) | no | "" |
| fail-on-finding | Fail the action if secrets are found | no | true |
| gitleaks-config | Path to custom Gitleaks config file | no | "" |
| results-dir | Directory to store results | no | .osdo/results |
Outputs
| name | description |
|---|---|
| findings | Total secrets found |
| secret-types | Types of secrets found |
| sarif-file | Path to SARIF output file |