Skip to content

Commit 808a1c7

Browse files
SundaresanGunasekarankarthickthangasamy
SundaresanGunasekaran
authored and
karthickthangasamy
committed
feature(REPORT-19988): GitHub-Actions-for-GitLeaks
1 parent b905490 commit 808a1c7

File tree

6 files changed

+309
-0
lines changed

6 files changed

+309
-0
lines changed

‎.github/workflows/gitleaks.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: GitLeaks Detect
2+
on: [push, pull_request]
3+
4+
jobs:
5+
Build:
6+
name: Run Script
7+
runs-on: windows-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
- name: Run Gitleaks installation
11+
run: ./GitleaksTasks/Build.ps1
12+
shell: pwsh

‎GitleaksTasks/.config/dotnet-tools.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": 1,
3+
"isRoot": true,
4+
"tools": {
5+
"cake.tool": {
6+
"version": "3.0.0",
7+
"commands": [
8+
"dotnet-cake"
9+
]
10+
}
11+
}
12+
}

‎GitleaksTasks/Build.ps1

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
##########################################################################
2+
# This is the Cake bootstrapper script for PowerShell.
3+
# This file was downloaded from https://github.com/cake-build/resources
4+
# Feel free to change this file to fit your needs.
5+
##########################################################################
6+
7+
<#
8+
9+
.SYNOPSIS
10+
This is a Powershell script to bootstrap a Cake build.
11+
12+
.DESCRIPTION
13+
This Powershell script will download NuGet if missing, restore NuGet tools (including Cake)
14+
and execute your Cake build script with the parameters you provide.
15+
16+
.PARAMETER Script
17+
The build script to execute.
18+
.PARAMETER Target
19+
The build script target to run.
20+
.PARAMETER ShowDescription
21+
Shows description about tasks.
22+
.PARAMETER SkipToolPackageRestore
23+
Skips restoring of packages.
24+
.PARAMETER ScriptArgs
25+
Remaining arguments are added here.
26+
27+
.LINK
28+
https://cakebuild.net
29+
30+
#>
31+
32+
[CmdletBinding()]
33+
Param(
34+
[string]$Script = "./GitleaksTasks/build.cake",
35+
[string]$Target = "Default"
36+
)
37+
38+
# Attempt to set highest encryption available for SecurityProtocol.
39+
# PowerShell will not set this by default (until maybe .NET 4.6.x). This
40+
# will typically produce a message for PowerShell v2 (just an info
41+
# message though)
42+
try {
43+
# Set TLS 1.2 (3072), then TLS 1.1 (768), then TLS 1.0 (192), finally SSL 3.0 (48)
44+
# Use integers because the enumeration values for TLS 1.2 and TLS 1.1 won't
45+
# exist in .NET 4.0, even though they are addressable if .NET 4.5+ is
46+
# installed (.NET 4.5 is an in-place upgrade).
47+
# PowerShell Core already has support for TLS 1.2 so we can skip this if running in that.
48+
if (-not $IsCoreCLR) {
49+
[System.Net.ServicePointManager]::SecurityProtocol = 3072 -bor 768 -bor 192 -bor 48
50+
}
51+
} catch {
52+
Write-Output 'Unable to set PowerShell to use TLS 1.2 and TLS 1.1 due to old .NET Framework installed. If you see underlying connection closed or trust errors, you may need to upgrade to .NET Framework 4.5+ and PowerShell v3'
53+
}
54+
55+
[Reflection.Assembly]::LoadWithPartialName("System.Security") | Out-Null
56+
function MD5HashFile([string] $filePath)
57+
{
58+
if ([string]::IsNullOrEmpty($filePath) -or !(Test-Path $filePath -PathType Leaf))
59+
{
60+
return $null
61+
}
62+
63+
[System.IO.Stream] $file = $null;
64+
[System.Security.Cryptography.MD5] $md5 = $null;
65+
try
66+
{
67+
$md5 = [System.Security.Cryptography.MD5]::Create()
68+
$file = [System.IO.File]::OpenRead($filePath)
69+
return [System.BitConverter]::ToString($md5.ComputeHash($file))
70+
}
71+
finally
72+
{
73+
if ($file -ne $null)
74+
{
75+
$file.Dispose()
76+
}
77+
}
78+
}
79+
80+
function GetProxyEnabledWebClient
81+
{
82+
$wc = New-Object System.Net.WebClient
83+
$proxy = [System.Net.WebRequest]::GetSystemWebProxy()
84+
$proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials
85+
$wc.Proxy = $proxy
86+
return $wc
87+
}
88+
89+
Write-Host "Preparing to run build script..."
90+
91+
#if(!$PSScriptRoot){
92+
$PSScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
93+
#}
94+
$directorypath = if ($PSScriptRoot) { $PSScriptRoot } `
95+
elseif ($psise) { split-path $psise.CurrentFile.FullPath } `
96+
elseif ($psEditor) { split-path $psEditor.GetEditorContext().CurrentFile.Path }
97+
98+
$TOOLS_DIR = Join-Path $directorypath "tools"
99+
$ADDINS_DIR = Join-Path $TOOLS_DIR "Addins"
100+
$MODULES_DIR = Join-Path $TOOLS_DIR "Modules"
101+
$NUGET_EXE = Join-Path $TOOLS_DIR "nuget.exe"
102+
$CAKE_EXE = Join-Path $TOOLS_DIR "Cake/Cake.exe"
103+
$NUGET_URL = "https://dist.nuget.org/win-x86-commandline/latest/nuget.exe"
104+
$PACKAGES_CONFIG = Join-Path $TOOLS_DIR "packages.config"
105+
$PACKAGES_CONFIG_MD5 = Join-Path $TOOLS_DIR "packages.config.md5sum"
106+
$ADDINS_PACKAGES_CONFIG = Join-Path $ADDINS_DIR "packages.config"
107+
$MODULES_PACKAGES_CONFIG = Join-Path $MODULES_DIR "packages.config"
108+
109+
# Make sure tools folder exists
110+
if ((Test-Path $directorypath) -and !(Test-Path $TOOLS_DIR)) {
111+
Write-Verbose -Message "Creating tools directory..."
112+
New-Item -Path $TOOLS_DIR -Type Directory | Out-Null
113+
}
114+
115+
# Make sure that packages.config exist.
116+
if (!(Test-Path $PACKAGES_CONFIG)) {
117+
Write-Verbose -Message "Downloading packages.config..."
118+
try {
119+
$wc = GetProxyEnabledWebClient
120+
$wc.DownloadFile("https://cakebuild.net/download/bootstrapper/packages", $PACKAGES_CONFIG)
121+
} catch {
122+
Throw "Could not download packages.config."
123+
}
124+
}
125+
126+
# Try find NuGet.exe in path if not exists
127+
if (!(Test-Path $NUGET_EXE)) {
128+
Write-Verbose -Message "Trying to find nuget.exe in PATH..."
129+
$existingPaths = $Env:Path -Split ';' | Where-Object { (![string]::IsNullOrEmpty($_)) -and (Test-Path $_ -PathType Container) }
130+
$NUGET_EXE_IN_PATH = Get-ChildItem -Path $existingPaths -Filter "nuget.exe" | Select -First 1
131+
if ($NUGET_EXE_IN_PATH -ne $null -and (Test-Path $NUGET_EXE_IN_PATH.FullName)) {
132+
Write-Verbose -Message "Found in PATH at $($NUGET_EXE_IN_PATH.FullName)."
133+
$NUGET_EXE = $NUGET_EXE_IN_PATH.FullName
134+
}
135+
}
136+
137+
# Try download NuGet.exe if not exists
138+
if (!(Test-Path $NUGET_EXE)) {
139+
Write-Verbose -Message "Downloading NuGet.exe..."
140+
try {
141+
$wc = GetProxyEnabledWebClient
142+
$wc.DownloadFile($NUGET_URL, $NUGET_EXE)
143+
} catch {
144+
Throw "Could not download NuGet.exe."
145+
}
146+
}
147+
148+
# Save nuget.exe path to environment to be available to child processed
149+
$env:NUGET_EXE = $NUGET_EXE
150+
$env:NUGET_EXE_INVOCATION = if ($IsLinux -or $IsMacOS) {
151+
"mono `"$NUGET_EXE`""
152+
} else {
153+
"`"$NUGET_EXE`""
154+
}
155+
156+
# Restore tools from NuGet?
157+
if(-Not $SkipToolPackageRestore.IsPresent) {
158+
Push-Location
159+
Set-Location $TOOLS_DIR
160+
161+
# Check for changes in packages.config and remove installed tools if true.
162+
[string] $md5Hash = MD5HashFile $PACKAGES_CONFIG
163+
if((!(Test-Path $PACKAGES_CONFIG_MD5)) -Or
164+
($md5Hash -ne (Get-Content $PACKAGES_CONFIG_MD5 ))) {
165+
Write-Verbose -Message "Missing or changed package.config hash..."
166+
Get-ChildItem -Exclude packages.config,nuget.exe,Cake.Bakery |
167+
Remove-Item -Recurse
168+
}
169+
170+
Write-Verbose -Message "Restoring tools from NuGet..."
171+
172+
$NuGetOutput = Invoke-Expression "& $env:NUGET_EXE_INVOCATION install -ExcludeVersion -OutputDirectory `"$TOOLS_DIR`""
173+
174+
if ($LASTEXITCODE -ne 0) {
175+
Throw "An error occurred while restoring NuGet tools."
176+
}
177+
else
178+
{
179+
$md5Hash | Out-File $PACKAGES_CONFIG_MD5 -Encoding "ASCII"
180+
}
181+
Write-Verbose -Message ($NuGetOutput | Out-String)
182+
183+
Pop-Location
184+
}
185+
186+
# Restore addins from NuGet
187+
if (Test-Path $ADDINS_PACKAGES_CONFIG) {
188+
Push-Location
189+
Set-Location $ADDINS_DIR
190+
191+
Write-Verbose -Message "Restoring addins from NuGet..."
192+
$NuGetOutput = Invoke-Expression "& $env:NUGET_EXE_INVOCATION install -ExcludeVersion -OutputDirectory `"$ADDINS_DIR`""
193+
194+
if ($LASTEXITCODE -ne 0) {
195+
Throw "An error occurred while restoring NuGet addins."
196+
}
197+
198+
Write-Verbose -Message ($NuGetOutput | Out-String)
199+
200+
Pop-Location
201+
}
202+
203+
# Restore modules from NuGet
204+
if (Test-Path $MODULES_PACKAGES_CONFIG) {
205+
Push-Location
206+
Set-Location $MODULES_DIR
207+
208+
Write-Verbose -Message "Restoring modules from NuGet..."
209+
$NuGetOutput = Invoke-Expression "& $env:NUGET_EXE_INVOCATION install -ExcludeVersion -OutputDirectory `"$MODULES_DIR`""
210+
211+
if ($LASTEXITCODE -ne 0) {
212+
Throw "An error occurred while restoring NuGet modules."
213+
}
214+
215+
Write-Verbose -Message ($NuGetOutput | Out-String)
216+
217+
Pop-Location
218+
}
219+
220+
# Make sure that Cake has been installed.
221+
if (!(Test-Path $CAKE_EXE)) {
222+
Throw "Could not find Cake.exe at $CAKE_EXE"
223+
}
224+
225+
$CAKE_EXE_INVOCATION = if ($IsLinux -or $IsMacOS) {
226+
"mono `"$CAKE_EXE`""
227+
} else {
228+
"`"$CAKE_EXE`""
229+
}
230+
231+
232+
# Build Cake arguments
233+
$cakeArguments = @("$Script");
234+
if ($Target) { $cakeArguments += "-target=$Target" }
235+
if ($Configuration) { $cakeArguments += "-configuration=$Configuration" }
236+
if ($ShowDescription) { $cakeArguments += "-showdescription" }
237+
if ($DryRun) { $cakeArguments += "-dryrun" }
238+
$cakeArguments += $ScriptArgs
239+
240+
# Start Cake
241+
Write-Host "Running build script..."
242+
Invoke-Expression "& $CAKE_EXE_INVOCATION `"$Script`" "
243+
exit $LASTEXITCODE

‎GitleaksTasks/build.cake

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
var target = Argument("target", "Default");
2+
3+
using Cake.Common.Net;
4+
using Cake.Common.IO;
5+
//////////////////////////////////////////////////////////////////////
6+
// TASKS
7+
//////////////////////////////////////////////////////////////////////
8+
9+
Task("GitLeaksDownload")
10+
.Does(() => {
11+
DownloadFile("https://github.com/zricethezav/gitleaks/releases/download/v8.15.2/gitleaks_8.15.2_windows_x64.zip", "GitLeaks.zip");
12+
Unzip("GitLeaks.zip", "./GitLeaks");
13+
CopyFile("./GitLeaks/gitleaks.exe", "../gitleaks.exe");
14+
});
15+
16+
Task("Default")
17+
.IsDependentOn("GitLeaksDownload")
18+
.Does(()=>{
19+
CreateDirectory("../GitLeaksReport");
20+
if (FileExists("../gitleaks.toml"))
21+
{
22+
StartProcess("../gitleaks.exe", new ProcessSettings {Arguments ="detect --verbose --report-path ../GitLeaksReport/gitleaks-report.json -c ../gitleaks.toml"});
23+
}
24+
else {
25+
StartProcess("../gitleaks.exe", new ProcessSettings {Arguments ="detect --verbose --report-path ../GitLeaksReport/gitleaks-report.json"});
26+
}
27+
});
28+
29+
//////////////////////////////////////////////////////////////////////
30+
// EXECUTION
31+
//////////////////////////////////////////////////////////////////////
32+
33+
RunTarget(target);

‎GitleaksTasks/tools/packages.config

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<packages>
3+
<package id="Cake" version="0.38.5" />
4+
</packages>

‎gitleaks.toml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[[rules]]
2+
id = "generic-api-1"
3+
description = "Generic API Key"
4+
regex = '''KeyToken=b77a5c561934e089'''
5+
tags = ["key"]

0 commit comments

Comments
 (0)