niclas-zone/ci/gitleaksCI component for Gitleaks SAST tool that scans git repositories for hardcoded secrets, API keys, and tokens with custom and remote configuration support.
A GitLab CI component for Gitleaks - a SAST tool for detecting and preventing hardcoded secrets like passwords, API keys, and tokens in git repos.
include:
- component: $CI_SERVER_FQDN/niclas-zone/ci/gitleaks/main@latest
stages:
- test
include:
- component: $CI_SERVER_FQDN/niclas-zone/ci/gitleaks/main@latest
inputs:
GITLEAKS_CONFIG: ".gitleaks.toml"
GITLEAKS_EXTRA_ARGS: "--verbose --report-format sarif"
stages:
- test
include:
- component: $CI_SERVER_FQDN/niclas-zone/ci/gitleaks/main@latest
inputs:
GITLEAKS_REMOTE_CONFIG: "https://gitlab.com/niclas-zone/ci/gitleaks/-/raw/main/configs/gitleaks.toml"
stages:
- test
| Input | Description | Default |
|---|---|---|
job_name | Name of the CI job | "secret scanning" |
stage | Pipeline stage | "test" |
image | Docker image for Gitleaks | "registry.gitlab.com/niclas-zone/ctr/gitleaks:8.28.0" |
GITLEAKS_EXTRA_ARGS | Extra arguments for Gitleaks | "--verbose --redact --report-format json" |
GITLEAKS_CONFIG | Path to local Gitleaks config file | "" |
GITLEAKS_REMOTE_CONFIG | URL to download Gitleaks config file | "" |
Place a .gitleaks.toml file in your repository root or specify the path using GITLEAKS_CONFIG.
Set GITLEAKS_REMOTE_CONFIG to download a configuration file from a URL. This is useful for sharing configurations across multiple projects.
If no local or remote configuration is specified, the component will use Gitleaks' built-in default rules.
The component generates the following artifacts:
gitleaks-report.json: Scan results in JSON format (or other format based on --report-format argument)For more information about Gitleaks configuration and options, see: