From a618d85b7683aae600258e5fb1f4672c166ba44e Mon Sep 17 00:00:00 2001
From: Daniil Kachalov <daniil.kachalov@flant.com>
Date: Mon, 15 Jun 2026 10:50:22 +0300
Subject: [PATCH] Refactor gitleaks action and  add gh cli install

Signed-off-by: Daniil Kachalov <daniil.kachalov@flant.com>
---
 gh/action.yml       | 40 ++++++++++++++++++++++++++++++++++++++++
 gitleaks/action.yml | 40 +++++++++++++++++++++++-----------------
 2 files changed, 63 insertions(+), 17 deletions(-)
 create mode 100644 gh/action.yml

diff --git a/gh/action.yml b/gh/action.yml
new file mode 100644
index 0000000..33ca516
--- /dev/null
+++ b/gh/action.yml
@@ -0,0 +1,40 @@
+name: "Install GH cli"
+description: "Install GH cli"
+
+inputs:
+  tool_version:
+    description: "GH cli version to install"
+    required: false
+    default: "v2.94.0"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install GH
+      shell: bash
+      run: |
+        set -euo pipefail
+        TOOL_NAME="gh"
+        TOOL_VERSION="${{ inputs.tool_version }}"
+        TOOL_PATH="$RUNNER_TOOL_CACHE/$TOOL_NAME/$TOOL_VERSION"
+        echo "$TOOL_PATH" >> "$GITHUB_PATH"
+        CACHED_VERSION=$($TOOL_PATH/$TOOL_NAME version | tr -d '\n' | cut -f 3 -d ' ' || true)
+        if [[ "${TOOL_VERSION#v}" != "$CACHED_VERSION" ]]; then
+          echo "Current $TOOL_NAME is $CACHED_VERSION, downloading ${TOOL_VERSION}";
+          arch="$(uname -m)"
+          case "$arch" in
+          x86_64|amd64)  pkg_arch="linux_amd64" ;;
+          aarch64|arm64) pkg_arch="linux_arm64" ;;
+          *) echo "Unsupported arch: $arch"; exit 1 ;;
+          esac
+          file_ver="${TOOL_VERSION#v}"
+          tgz="${TOOL_NAME}_${file_ver}_${pkg_arch}.tar.gz"
+          mkdir -p "$TOOL_PATH"
+          curl -Lsfo "$TOOL_PATH/$tgz" https://github.com/cli/cli/releases/download/${TOOL_VERSION}/${tgz}
+          tar -xzf $TOOL_PATH/$tgz -C $TOOL_PATH/
+          mv $TOOL_PATH/${TOOL_NAME}_${file_ver}_${pkg_arch}/bin/${TOOL_NAME} $TOOL_PATH/$TOOL_NAME
+          rm -rf $TOOL_PATH/$tgz $TOOL_PATH/${TOOL_NAME}_${file_ver}_${pkg_arch}
+          chmod +x "$TOOL_PATH/$TOOL_NAME"
+        else
+          echo "Current $TOOL_NAME is $CACHED_VERSION, skipping download"
+        fi
diff --git a/gitleaks/action.yml b/gitleaks/action.yml
index 3b8d0c9..379e15e 100644
--- a/gitleaks/action.yml
+++ b/gitleaks/action.yml
@@ -33,23 +33,29 @@ runs:
       shell: bash
       run: |
         set -euo pipefail
-        ver="${{ inputs.gitleaks_version }}"
-        file_ver="${ver#v}"
-        arch="$(uname -m)"
-        case "$arch" in
-          x86_64|amd64)  pkg_arch="linux_x64" ;;
-          aarch64|arm64) pkg_arch="linux_arm64" ;;
-          *) echo "Unsupported arch: $arch"; exit 1 ;;
-        esac
-        base="https://github.com/gitleaks/gitleaks/releases/download/${ver}"
-        tgz="gitleaks_${file_ver}_${pkg_arch}.tar.gz"
-        curl -sSL "$base/$tgz" -o gitleaks.tgz
-        tar -xzf gitleaks.tgz gitleaks
-        chmod +x gitleaks
-        install_dir="$HOME/.local/bin"; mkdir -p "$install_dir"
-        mv gitleaks "$install_dir/gitleaks"
-        echo "$install_dir" >> "$GITHUB_PATH"
-        gitleaks version
+        TOOL_NAME="gitleaks"
+        TOOL_VERSION="${{ inputs.gitleaks_version }}"
+        TOOL_PATH="$RUNNER_TOOL_CACHE/$TOOL_NAME/$TOOL_VERSION"
+        echo "$TOOL_PATH" >> "$GITHUB_PATH"
+        CACHED_VERSION=$($TOOL_PATH/$TOOL_NAME version | tr -d '\n' || true)
+        if [[ "${TOOL_VERSION}" != "$CACHED_VERSION" ]]; then
+          echo "Current $TOOL_NAME is $CACHED_VERSION, downloading ${TOOL_VERSION}";
+          arch="$(uname -m)"
+          case "$arch" in
+            x86_64|amd64)  pkg_arch="linux_x64" ;;
+            aarch64|arm64) pkg_arch="linux_arm64" ;;
+            *) echo "Unsupported arch: $arch"; exit 1 ;;
+          esac
+          file_ver="${TOOL_VERSION#v}"
+          tgz="${TOOL_NAME}_${file_ver}_${pkg_arch}.tar.gz"
+          mkdir -p "$TOOL_PATH"
+          curl -Lsfo "$TOOL_PATH/$tgz" https://github.com/gitleaks/gitleaks/releases/download/${TOOL_VERSION}/${tgz}
+          tar -xzf $TOOL_PATH/$tgz -C $TOOL_PATH/
+          rm -v $TOOL_PATH/$tgz
+          chmod +x "$TOOL_PATH/$TOOL_NAME"
+        else
+          echo "Current $TOOL_NAME is $CACHED_VERSION, skipping download"
+        fi
 
     - name: Setup centralized config
       shell: bash