feat: add Gitleaks config and CI workflow by stevefulme1 · Pull Request #22 · redhat-cop/openshift_virtualization_migration

stevefulme1 · 2026-04-06T17:39:04Z

Summary

Adds .gitleaks.toml with default rules extended by custom Ansible-specific credential detection patterns (OpenShift API keys, Automation Hub tokens, container registry passwords)
Configures allowlists for placeholder values (changeme), Jinja2 template variables ({{ }}), Ansible Vault references, example domains, and YAML comments
Adds path-based allowlists for defaults/main.yml and inventory.yml where variable declarations use block scalar indicators
Adds .github/workflows/gitleaks.yml GitHub Actions workflow to run Gitleaks on pushes to main and all PRs
Complements the existing Gitleaks pre-commit hook in .pre-commit-config.yaml

Test plan

Verify gitleaks detect --config .gitleaks.toml --no-git reports no false positives on the current codebase
Verify the GitHub Actions workflow triggers on PR creation
Test that a commit containing a real secret (e.g., a test API key) is detected and flagged
Confirm pre-commit hook still works with the new config file

🤖 Generated with Claude Code

sabre1041 · 2026-04-13T05:39:52Z

@luizfao @jeffcpullen Would you be able to review the content of this PR?

jeffcpullen · 2026-04-14T00:33:06Z

Not an expert it GitHub actions or Gitleaks, but it looks like what I would expect to see. I appreciate the carve out on specific files with specific criteria "changeme" password placeholders. Going to let this run to review the output.

jeffcpullen · 2026-04-14T01:19:14Z

Ok, the run failed with 11 false positives.

10 of the 11 were looking at README.md files that do not contain secrets, but instead are documenting variables. For example, this line triggered Gitleaks.

<b>vm_ssh_openshift_api_key:</b> OpenShift API Key

The last one triggered the 'create_mf_aap_token_openshift_api_key' variable becuase it uses a multi-line YAML format.

    - name: Set fact with Service Account API key
      ansible.builtin.set_fact:
        create_mf_aap_token_openshift_api_key: >-
          "{{ create_mf_aap_token_migration_factory_aap_sa_token.resources[0].data.token | b64decode }}"
      no_log: "{{ create_mf_aap_token_secure_logging }}"

stevefulme1 · 2026-04-14T14:06:44Z

@jeffcpullen Thanks for running it and flagging those! I've pushed a fix (deaa285) that resolves all 11 false positives:

Changes to .gitleaks.toml:

Added README.md to the global path allowlist — these files contain docsible-generated variable documentation (e.g., <b>vm_ssh_openshift_api_key:</b> OpenShift API Key), not actual secrets
Added <b>.*</b> regex allowlist — catches the HTML bold tag pattern used to document variable names in READMEs
Added [>|][+-]?\s*$ regex allowlist — catches multi-line YAML block scalars (>-, |, etc.) where the value is a Jinja2 template on the following line (e.g., create_mf_aap_token_openshift_api_key: >-)
Extended per-rule path allowlists — added README.md and tasks/main.yml to the openshift-api-key and container-registry-password rules

Verified locally: gitleaks detect --config .gitleaks.toml -v now returns 0 leaks across all 43 commits.

sabre1041

LGTM

Adds .gitleaks.toml with custom rules for Ansible-specific credential patterns (OpenShift API keys, Automation Hub tokens, container registry passwords) and allowlists for placeholder values and Jinja2 templates. Adds a GitHub Actions workflow to run Gitleaks on pushes and PRs. Resolves: MFG-376 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add allowlists for docsible-generated README.md variable documentation (HTML bold tags), multi-line YAML block scalars (>- / |) where values are Jinja2 templates on the following line, and task files that reference credential variable names without containing actual secrets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove pull_request_target trigger to prevent untrusted PR code from running with write permissions. Remove conditional fork-detection logic and explicit SHA checkout that are no longer needed.

burigolucas

The new gitleaks workflow add two changes to the current secret scanning in the pre-commit and CI workflows:

It performs a full git history scanning not done in the other workflows
Uses a customization to the gitleaks config that extends the default configuration

The advantage of adding this workflow is the clear separation of concerns. This new workflow will provide secret scanning to all PRs (internal and from forks) without the need of manual approving as in the case of the CI workflow.

We should then consider whether we need to use the same gitleaks configuration to the other workflows as well.

burigolucas · 2026-06-29T08:55:54Z

This change is being addressed in PR #31. Please, remove it here.

Removed — deferring to PR #31 for this file.

burigolucas · 2026-06-29T08:56:00Z

This change is being addressed in PR #31. Please, remove it here.

Removed — deferring to PR #31 for this file.

burigolucas · 2026-06-29T08:56:05Z

This change is being addressed in PR #31. Please, remove it here.

Removed — deferring to PR #31 for this file.

burigolucas · 2026-06-29T08:56:09Z

This change is being addressed in PR #31. Please, remove it here.

Removed — deferring to PR #31 for this file.

burigolucas · 2026-06-29T09:03:45Z

+  pull_request:
+    branches: ["main"]
+  workflow_dispatch:
+


Add explicit permissions (best practice):

Suggested change

permissions:

contents: read

pull-requests: read

Added explicit permissions block.

burigolucas · 2026-06-29T09:04:40Z

+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2


Suggested change

uses: gitleaks/gitleaks-action@v2

uses: gitleaks/gitleaks-action@v3

Bumped to v3.

- Revert CODE_OF_CONDUCT.md, CONTRIBUTING.md to main (handled in PR redhat-cop#31) - Remove COPYING and SECURITY.md (handled in PR redhat-cop#31) - Add explicit permissions block to gitleaks workflow - Bump gitleaks-action from v2 to v3

…ration

stevefulme1 requested a review from sabre1041 as a code owner April 6, 2026 17:39

stevefulme1 temporarily deployed to external-ci April 6, 2026 17:39 — with GitHub Actions Inactive

stevefulme1 temporarily deployed to external-ci April 14, 2026 14:06 — with GitHub Actions Inactive

sabre1041 previously approved these changes Apr 14, 2026

View reviewed changes

stevefulme1 and others added 5 commits May 15, 2026 13:51

Update SECURITY.md with project-specific content

0f9c8a0

docs: standardize security policy to Ansible community standard

b714c78

docs: standardize contributing guide to Ansible community standard

464b4bc

docs: standardize code of conduct to Ansible community standard

612ed3a

docs: standardize license to GPL-3.0

a294bc5

burigolucas self-requested a review June 26, 2026 08:45

stevefulme1 and others added 3 commits June 26, 2026 11:21

fix(ci): remove unsafe pull_request_target from gitleaks workflow

e359002

Remove pull_request_target trigger to prevent untrusted PR code from running with write permissions. Remove conditional fork-detection logic and explicit SHA checkout that are no longer needed.

stevefulme1 dismissed sabre1041’s stale review via e359002 June 26, 2026 15:21

stevefulme1 force-pushed the feat/gitleaks-configuration branch from deaa285 to e359002 Compare June 26, 2026 15:21

stevefulme1 requested a deployment to external-ci June 26, 2026 15:21 — with GitHub Actions Waiting

burigolucas requested changes Jun 29, 2026

View reviewed changes

stevefulme1 added 3 commits June 29, 2026 10:05

fix: address PR review feedback

f246057

- Revert CODE_OF_CONDUCT.md, CONTRIBUTING.md to main (handled in PR redhat-cop#31) - Remove COPYING and SECURITY.md (handled in PR redhat-cop#31) - Add explicit permissions block to gitleaks workflow - Bump gitleaks-action from v2 to v3

Merge remote-tracking branch 'origin/main' into feat/gitleaks-configu…

dfbfae7

…ration

docs: regenerate network_mgmt README after OVN layer2 merge

c70cf2f

+permissions:
+  contents: read
+  pull-requests: read

	uses: gitleaks/gitleaks-action@v2
	uses: gitleaks/gitleaks-action@v3

Uh oh!

Conversation

stevefulme1 commented Apr 6, 2026

Summary

Related

Test plan

Uh oh!

sabre1041 commented Apr 13, 2026

Uh oh!

jeffcpullen commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jeffcpullen commented Apr 14, 2026

Uh oh!

stevefulme1 commented Apr 14, 2026

Uh oh!

sabre1041 left a comment

Choose a reason for hiding this comment

Uh oh!

burigolucas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jeffcpullen commented Apr 14, 2026 •

edited

Loading