From a0e9f58f7a3e7910cce32558d745ce7d870dcec1 Mon Sep 17 00:00:00 2001 From: Paul Foley <8870031+Soul-Craft@users.noreply.github.com> Date: Sat, 17 Oct 2026 16:04:00 -0600 Subject: [PATCH] gitleaks: scan HEAD's history, not every fetched branch The full-depth checkout fetches all branches, and gitleaks git defaults to --all, so a finding on one open PR's branch (site bf417f4) failed every other site PR. --log-opts=HEAD keeps the whole history of what would land (on a PR, the merge preview) and nothing else. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/gitleaks.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 019d0b6..0ad4534 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -51,5 +51,7 @@ jobs: echo "$sum $RUNNER_TEMP/gitleaks.tgz" | sha256sum -c - tar -xzf "$RUNNER_TEMP/gitleaks.tgz" -C "$RUNNER_TEMP" gitleaks + # HEAD's whole history (on a pull request, the merge preview: main plus the PR's commits), not --all. The + # full-depth checkout fetches every branch, and an unscoped scan let one open PR's finding fail every other PR. - name: no secret anywhere in the history - run: '"$RUNNER_TEMP/gitleaks" git --redact --verbose --exit-code 1 .' + run: '"$RUNNER_TEMP/gitleaks" git --log-opts=HEAD --redact --verbose --exit-code 1 .'