.github/workflows/gitleaks.yml runs the free gitleaks CLI. Call it from a private repository with contents: read; no license or inherited secrets are needed. Pin the reusable workflow to a reviewed commit SHA.
name: Secret scanning
on:
pull_request:
merge_group:
schedule:
- cron: '17 4 * * 1'
workflow_dispatch:
permissions:
contents: read
jobs:
secrets:
uses: 60xAI/.github/.github/workflows/gitleaks.yml@REVIEWED_COMMIT_SHA
with:
full_history: ${{ github.event_name != 'pull_request' && github.event_name != 'merge_group' }}The default runner remains GitHub-hosted ubuntu-latest. Repositories already
enabled for the organization's Blacksmith runners can pass use_blacksmith: true
alongside full_history to use blacksmith-4vcpu-ubuntu-2404. This changes only
where the same scan runs; its rules, history range, redaction, failure handling
and required secrets / gitleaks check remain unchanged. The boolean option
selects between these two labels rather than accepting arbitrary runner labels.
The job named secrets / gitleaks must pass on pull requests. PR scans cover commits between the base and head, including credentials added and subsequently removed in that range. Merge commits are diffed against their first parent, including credentials introduced only while resolving a conflict. Scheduled and manual runs scan every fetched branch and tag, including deleted files in reachable history. Unreachable or server-only objects are outside the scan.
The workflow fetches Git objects without checking out files or initializing submodules. Broken submodule metadata cannot disable the scan, and caller code is never executed. Git LFS object contents are outside this Git-object scan.
The central config extends the pinned gitleaks default rules with AI Brain sk_live_ API keys, GCP JSON private keys, MCP refresh tokens and client secrets, and contextual agent-mail browser/access tokens. Unprefixed tokens need a recognizable assignment name. The default rules also detect private keys, provider tokens, and JSON Web Tokens. These rules cannot identify every arbitrary random string.
Caller .gitleaks.toml, .gitleaksignore, and inline gitleaks:allow comments cannot waive this scan. The upstream rules include their normal file and synthetic-value exclusions. Reports retain only file paths and rule IDs. Raw scan output, matches, secret values, and code snippets are never published. A scanner error fails the job.
One reviewed exception recognizes the workspace Terraform helper's exact historical
Dagster password-rotation keeper. It is bound to 60xAI/ai-brain-workspace, the
generic-api-key rule, the exact script path and the complete non-secret assignment.
A different value, assignment, path or caller remains scanned; this does not allow
passwords or grant callers a configurable waiver. The scanner regression suite
checks all of these boundaries using an unissued credential-shaped canary.
When a scan fails, inspect the reported path privately. Assign genuine exposures to the owner of the credential and rotate under SOC2 F05. Remove the credential from current code; do not rewrite shared history. A weekly scan continues to fail for historical exposures until an explicit, reviewed exception policy exists. This workflow does not automatically waive old findings or rotate keys.
Run PATH="<gitleaks-bin>:$PATH" python3 tests/test_secret_scan.py to exercise the actual workflow scan step against synthetic credentials in a temporary Git repository. The gitleaks version must match the workflow. Validate workflow syntax with actionlint.