Skip to content

fix(ci): stop overwriting checksum-verified gitleaks with an unverified download #589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BitHighlander merged 1 commit into from
Aug 25, 2026
Merged

fix(ci): stop overwriting checksum-verified gitleaks with an unverified download #589

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 14 additions & 9 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,20 @@ jobs:
fetch-depth: 0

- name: Install gitleaks
# PINNED + checksum-verified. Tracking releases/latest means a new
# upstream ruleset can turn this gate red with no change to this
# repository -- which is exactly what happened: a newer
# generic-api-key rule began flagging published BIP32 test vectors
# in 2014/2018 history, and because every build job declares
# `needs: [.., secret-scan]`, the whole build and test graph was
# SKIPPED rather than failed. Bump deliberately, with the scan
# re-verified and a fresh sha256 recorded below. See #424.
#
# This used to install this checksummed build and then immediately
# overwrite it with a second, unverified `curl | tar` of a different
# (older) version -- so the binary actually executed was never the
# one the checksum covered, defeating the point of pinning at all.
# See #586.
run: |
GITLEAKS_VERSION=8.30.1
GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
Expand All @@ -106,15 +120,6 @@ jobs:
-o "${GITLEAKS_ARCHIVE}"
echo "${GITLEAKS_SHA256} ${GITLEAKS_ARCHIVE}" | sha256sum --check --strict
tar -xzf "${GITLEAKS_ARCHIVE}" -C /usr/local/bin gitleaks
# PINNED. Tracking releases/latest means a new upstream ruleset can turn
# this gate red with no change to this repository -- which is exactly what
# happened: a newer generic-api-key rule began flagging published BIP32 test
# vectors in 2014/2018 history, and because every build job declares
# `needs: [.., secret-scan]`, the whole build and test graph was SKIPPED
# rather than failed. Bump deliberately, with the scan re-verified. See #424.
GITLEAKS_VERSION=8.30.0
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
| tar -xz -C /usr/local/bin gitleaks
gitleaks version

- name: Run gitleaks
Expand Down
Loading