gitleaks_push.yaml

#####################################
#       DO NOT EDIT DIRECTLY.       #
# This file is managed by Terraform #
#####################################

on: [push]

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    name: Detect Secrets
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Checkout full history to make .gitleaksignore work like it does locally

      - name: GitLeaks
        uses: gacts/gitleaks@v1 # Action page: <https://github.com/gacts/gitleaks>
        with:
          version: 8.18.4

      - name: Email Security
        if: ${{ failure() && github.event.number == 0 }} # Only run for push events
        uses: JaSiLez/smtp-notifier@v1.1.3
        with:
          server_address: smtp.mandrillapp.com
          server_port: 465
          username: groq
          password: ${{ secrets.MANDRILL_API_KEY }}
          subject: Secret detected in GitHub repository '${{ github.event.repository.name }}'
          from: GitLeaks GitHub Action <no-reply@groq.com>
          to: definitive-security@groq.com
          convert_markdown: true
          html_body: |
            Secret detected in ${{ github.event.repository.url }}. See details below:

            * action: ${{ github.event.repository.url }}/actions/runs/${{ github.run_id }}
            * commit: ${{ github.event.head_commit.url }}