thadiust/Gitleaks secrets scan
Run Gitleaks to detect hardcoded secrets; does not print secret values in logs
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| gitleaks_version | Exact Gitleaks release version (no v prefix) | no | 8.18.4 |
| working_directory | Directory to scan (repo root relative). With no_git=false (default), this must be a git repository. With no_git=true, a plain directory tree is enough. | no | . |
| config_path | Optional Gitleaks config path relative to working_directory (e.g. .gitleaks.toml) | no | "" |
| baseline_path | Optional baseline report path relative to working_directory (existing findings ignored) | no | "" |
| no_git | If true, scan files only (--no-git) instead of git history | no | false |
| fail_on_findings | Fail the action when one or more findings are reported | no | true |
| write_sarif | Write a SARIF 2.1 report to sarif_filename (for GitHub Code Scanning upload) | no | false |
| sarif_filename | SARIF file path relative to working_directory (used when write_sarif is true) | no | gitleaks-results.sarif |
Outputs
| name | description |
|---|---|
| secret_count | Number of findings reported by Gitleaks |
| scan_status | Final scan status (clean, findings_found, scanner_error) |
| sarif_path | Repo-relative path to the SARIF report when write_sarif is true (empty otherwise) |