diff --git a/rule-types/github/gitleaks_github_action.test.yaml b/rule-types/github/gitleaks_github_action.test.yaml new file mode 100644 index 0000000..e061cc8 --- /dev/null +++ b/rule-types/github/gitleaks_github_action.test.yaml @@ -0,0 +1,13 @@ +tests: + - name: "Should have Gitleaks enabled" + def: {} + params: {} + expect: "pass" + git: + repo_base: github_action_with_gitleaks + - name: "Should not have Gitleaks enabled" + def: {} + params: {} + expect: "fail" + git: + repo_base: github_action_without_gitleaks diff --git a/rule-types/github/gitleaks_github_action.testdata/github_action_with_gitleaks/gitleaks.yaml b/rule-types/github/gitleaks_github_action.testdata/github_action_with_gitleaks/gitleaks.yaml new file mode 100644 index 0000000..cea4081 --- /dev/null +++ b/rule-types/github/gitleaks_github_action.testdata/github_action_with_gitleaks/gitleaks.yaml @@ -0,0 +1,14 @@ +name: gitleaks +on: + workflow_dispatch: + schedule: + # Run every 15 minutes + - cron: '0/15 * * * *' +jobs: + gitleaks: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4.2.2 + - name: Self-hosted Gitleaks + uses: gitleaks/gitleaks-action@v2 diff --git a/rule-types/github/gitleaks_github_action.testdata/github_action_without_gitleaks/not-gitleaks.yaml b/rule-types/github/gitleaks_github_action.testdata/github_action_without_gitleaks/not-gitleaks.yaml new file mode 100644 index 0000000..1e929a7 --- /dev/null +++ b/rule-types/github/gitleaks_github_action.testdata/github_action_without_gitleaks/not-gitleaks.yaml @@ -0,0 +1,12 @@ +name: Just Checkout +on: + workflow_dispatch: + schedule: + # Run every 15 minutes + - cron: '0/15 * * * *' +jobs: + gitleaks: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4.2.2 \ No newline at end of file diff --git a/rule-types/github/gitleaks_github_action.yaml b/rule-types/github/gitleaks_github_action.yaml new file mode 100644 index 0000000..1fd6f24 --- /dev/null +++ b/rule-types/github/gitleaks_github_action.yaml @@ -0,0 +1,43 @@ +--- +version: v1 +release_phase: alpha +type: rule-type +name: gitleaks_github_action +display_name: Enable Gitleaks to prevent leakage of passwords or keys +short_failure_message: Gitleaks is not configured via a GitHub action +severity: + value: medium +context: {} +description: | + Verifies that Gitleaks is configured via a GitHub action for the repository. +guidance: | + Ensure that Gitleaks is configured and enabled for the repository. + Gitleaks is an open-source secret scanner for git repositories, files, and directories. + For more information, see the [GitHub Action Gitleaks](https://github.com/gitleaks/gitleaks-action) documentation. +def: + in_entity: repository + rule_schema: + type: object + properties: {} + ingest: + type: git + git: {} + eval: + type: rego + rego: + type: deny-by-default + def: | + package minder + + import rego.v1 + + actions := github_workflow.ls_actions("./.github/workflows") + + default message := "Gitleaks GitHub action is not configured" + default allow := false + allow if contains(actions[_], "gitleaks/gitleaks-action") + + # Defines the configuration for alerting on the rule + alert: + type: security_advisory + security_advisory: {}