Gitleaks scan and publish to CloudBees Unify

Use this action to perform static application security testing (SAST) on a repository with the Gitleaks scanner, and then view comprehensive security results in CloudBees Unify.

Prerequisites

Set up CloudBees Unify and GHA to work together, providing key features of CloudBees Unify to GHA workflows. Refer to Getting started for more information.

Inputs

Table 1. Input details
Input name	Data type	Required?	Description
`cloudbees-pat`	String	Yes	The CloudBees Unify personal access token.
`cloudbees-url`	String	No	The CloudBees Unify URL. The default value is `https://api.cloudbees.io`.
`ref`	String	No	The commit reference to be checked out and archived.

Usage examples

Basic example

The following is a basic example of using this action:

      - name: Scan with Gitleaks
        uses: cloudbees-io-gha/gitleaks-scan-publish@v1
        with:
          cloudbees-pat: ${{ secrets.CloudBees-platform-PAT }}▼

Full workflow example

The following GHA workflow example scans a repository with Gitleaks.

name: Gitleaks scan workflow

on:
  push:
    branches:
    - main

jobs:
  gitleaks-codescan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
        uses: actions/checkout@v3

      - name: Gitleaks scan
        uses: cloudbees-io-gha/gitleaks-scan-publish@v1
        with:
          cloudbees-pat: ${{ secrets.CLOUDBEES_PAT }}
          ref: refs/heads/featureA▼

After the GHA run has completed, the security findings are collected and displayed in the CloudBees Unify Component security center for the component containing the workflow.