mirror of
https://github.com/trufflesecurity/trufflehog.git
synced 2024-11-13 00:17:18 +00:00
93 lines
3.1 KiB
YAML
93 lines
3.1 KiB
YAML
name: 'TruffleHog OSS'
|
||
description: 'Scan Github Actions with TruffleHog.'
|
||
author: Truffle Security Co. <support@trufflesec.com>
|
||
|
||
inputs:
|
||
path:
|
||
description: Repository path
|
||
required: false
|
||
default: "./"
|
||
base:
|
||
description: Start scanning from here (usually main branch).
|
||
required: false
|
||
default: ''
|
||
head:
|
||
description: Scan commits until here (usually dev branch).
|
||
required: false
|
||
extra_args:
|
||
default: ''
|
||
description: Extra args to be passed to the trufflehog cli.
|
||
required: false
|
||
branding:
|
||
icon: "shield"
|
||
color: "green"
|
||
|
||
runs:
|
||
using: "composite"
|
||
steps:
|
||
- shell: bash
|
||
env:
|
||
REPO_PATH: ${{ inputs.path }}
|
||
BASE: ${{ inputs.base }}
|
||
HEAD: ${{ inputs.head }}
|
||
ARGS: ${{ inputs.extra_args }}
|
||
COMMITS: ${{ toJson(github.event.commits) }}
|
||
run: |
|
||
##########################################
|
||
## ADVANCED USAGE ##
|
||
## Scan by BASE & HEAD user inputs ##
|
||
## If BASE == HEAD, exit with error ##
|
||
##########################################
|
||
if [ -n "$BASE" ] || [ -n "$HEAD" ]; then
|
||
if [ -n "$BASE" ]; then
|
||
base_commit=$(git rev-parse "$BASE" 2>/dev/null) || true
|
||
else
|
||
base_commit=""
|
||
fi
|
||
if [ -n "$HEAD" ]; then
|
||
head_commit=$(git rev-parse "$HEAD" 2>/dev/null) || true
|
||
else
|
||
head_commit=""
|
||
fi
|
||
if [ $base_commit == $head_commit ] ; then
|
||
echo "::error::BASE and HEAD commits are the same. TruffleHog won't scan anything. Please see documentation (https://github.com/trufflesecurity/trufflehog#octocat-trufflehog-github-action)."
|
||
exit 1
|
||
fi
|
||
##########################################
|
||
## Scan commits based on event type ##
|
||
##########################################
|
||
else
|
||
if [ "${{ github.event_name }}" == "push" ]; then
|
||
COMMIT_LENGTH=$(printenv COMMITS | jq length)
|
||
if [ $COMMIT_LENGTH == "0" ]; then
|
||
echo "No commits to scan"
|
||
exit 0
|
||
fi
|
||
HEAD=${{ github.event.after }}
|
||
if [ ${{ github.event.before }} == "0000000000000000000000000000000000000000" ]; then
|
||
BASE=$(git rev-parse $HEAD~$COMMIT_LENGTH)
|
||
else
|
||
BASE=${{ github.event.before }}
|
||
fi
|
||
elif [ "${{ github.event_name }}" == "workflow_dispatch" ] || [ "${{ github.event_name }}" == "schedule" ]; then
|
||
BASE=""
|
||
HEAD=""
|
||
elif [ "${{ github.event_name }}" == "pull_request" ]; then
|
||
BASE=${{github.event.pull_request.base.sha}}
|
||
HEAD=${{github.event.pull_request.head.sha}}
|
||
fi
|
||
fi
|
||
##########################################
|
||
## Run TruffleHog ##
|
||
##########################################
|
||
docker run --rm -v "$REPO_PATH":/tmp \
|
||
ghcr.io/trufflesecurity/trufflehog:latest \
|
||
git file:///tmp/ \
|
||
--since-commit \
|
||
${BASE:-''} \
|
||
--branch \
|
||
${HEAD:-''} \
|
||
--fail \
|
||
--no-update \
|
||
--github-actions \
|
||
${ARGS:-''}
|