b936f8ab20- .tekton/code-scans.yaml — runs gitleaks v8.30.1 on push and PR to main - .pre-commit-config.yaml — local pre-commit hook (gitleaks v8.30.1) - .gitleaks.toml — extends defaults; YAML allowlist mirrors b4mad config; commit allowlist for three historical commits with already- rotated credentials so the pipeline starts green. Adapted from b4mad/op1st-emea-b4mad reference configs.
70 lines
1.7 KiB
YAML
70 lines
1.7 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: PipelineRun
|
|
metadata:
|
|
name: code-scans
|
|
annotations:
|
|
pipelinesascode.tekton.dev/on-event: "[push, pull_request]"
|
|
pipelinesascode.tekton.dev/on-target-branch: "[main]"
|
|
pipelinesascode.tekton.dev/task: "[git-clone]"
|
|
pipelinesascode.tekton.dev/max-keep-runs: "5"
|
|
pipelinesascode.tekton.dev/cancel-in-progress: "true"
|
|
spec:
|
|
params:
|
|
- name: repo_url
|
|
value: "{{ repo_url }}"
|
|
- name: revision
|
|
value: "{{ revision }}"
|
|
pipelineSpec:
|
|
params:
|
|
- name: repo_url
|
|
- name: revision
|
|
workspaces:
|
|
- name: source
|
|
tasks:
|
|
- name: fetch-source
|
|
taskRef:
|
|
name: git-clone
|
|
workspaces:
|
|
- name: output
|
|
workspace: source
|
|
params:
|
|
- name: url
|
|
value: $(params.repo_url)
|
|
- name: revision
|
|
value: $(params.revision)
|
|
|
|
- name: gitleaks-version
|
|
taskSpec:
|
|
steps:
|
|
- name: gitleaks
|
|
image: ghcr.io/gitleaks/gitleaks:v8.30.1
|
|
args:
|
|
- version
|
|
|
|
- name: gitleaks
|
|
runAfter:
|
|
- fetch-source
|
|
workspaces:
|
|
- name: source
|
|
workspace: source
|
|
taskSpec:
|
|
workspaces:
|
|
- name: source
|
|
steps:
|
|
- name: gitleaks
|
|
image: ghcr.io/gitleaks/gitleaks:v8.30.1
|
|
workingDir: $(workspaces.source.path)
|
|
args:
|
|
- git
|
|
- $(workspaces.source.path)
|
|
- --verbose
|
|
|
|
workspaces:
|
|
- name: source
|
|
volumeClaimTemplate:
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|