ci(gitleaks): switch to pull_request_target so fork PRs get GITLEAKS_LICENSE - #31
Merged
Merged
Conversation
…AKS_LICENSE
Fork PRs (isCrossRepository=true) run with secrets stripped under the
'pull_request' event, so ${{ secrets.GITLEAKS_LICENSE }} resolves to
empty and the action fails with 'missing gitleaks license'.
pull_request_target runs in the base-repo context where org secrets
are available. We explicitly check out the PR head SHA so the scan
covers the contributor's commits. The job only runs gitleaks-action
(pinned by SHA) on the checked-out tree — no build, no install, no
PR-controlled scripts execute — so the usual pull_request_target risk
does not apply here.
yotamleo
requested review from
ar7casper,
dgeyshis,
shahar-davidson and
sounil
as code owners
May 4, 2026 08:57
dgeyshis
approved these changes
May 4, 2026
Closed
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
joshbouncesecurity/OpenAnt) currently fail thegitleakscheck withmissing gitleaks license. GitHub strips secrets frompull_requestruns whose head is in a fork, so${{ secrets.GITLEAKS_LICENSE }}resolves to an empty string and gitleaks-action rejects the org.pull_request_target, which runs in the base-repo context with org secrets available. Explicitly check outpull_request.head.shaso the scan still covers the contributor's commits, and update the scan-range branch to match the new event name.Why this is safe
pull_request_targetis dangerous when a workflow executes PR-controlled code (build steps,npm install,pip install, etc.). This workflow does not — it only runsgitleaks/gitleaks-actionpinned by full SHA against the checked-out tree. No installer, no script execution, no test runner. The action reads files; it does not evaluate them.Test plan
gitleaksSUCCESS with the license env populated.master→ confirm push-event scan range falls through to theBEFORE_SHA..HEADbranch.🤖 Generated with Claude Code