Scan GitHub Repos for Committed Secrets with gitleaks

id: github-secret-scan-gitleaks-on-push
namespace: company.team
description: |
  Scan a GitHub repository for committed secrets on every push with
  gitleaks: check out the repository into a shared working directory,
  run the scanner in its official container with redacted output, parse
  the JSON report, and when a leak is found open a labeled GitHub issue,
  alert Slack, and fail the run.

triggers:
  - id: on_push
    type: io.kestra.plugin.core.trigger.Webhook
    description: GitHub (or your CI) POSTs here on every push to re-scan the
      repository. Shipped with a keyed URL — treat the key as a secret.
    key: "{{ secret('SECRET_SCAN_WEBHOOK_KEY') }}"

inputs:
  - id: repository
    type: STRING
    defaults: your-org/your-repo
    description: GitHub repository to scan, in owner/repo form — used for cloning
      and as the target for the issue it opens.
  - id: branch
    type: STRING
    defaults: main
    description: Branch to check out and scan.
  - id: git_username
    type: STRING
    defaults: x-access-token
    description: Username sent to git when cloning; keep the default when
      authenticating with a personal access token.

tasks:
  - id: workspace
    type: io.kestra.plugin.core.flow.WorkingDirectory
    description: One shared directory so the clone, the scanner container, and the
      report parser all see the same files.
    tasks:
      - id: clone_repository
        type: io.kestra.plugin.git.Clone
        description: Check out the repository under scan at the configured branch,
          authenticated with the GitHub token.
        url: "https://github.com/{{ inputs.repository }}.git"
        username: "{{ inputs.git_username }}"
        password: "{{ secret('GITHUB_TOKEN') }}"
        branch: "{{ inputs.branch }}"

      - id: run_secret_scan
        type: io.kestra.plugin.scripts.shell.Commands
        description: Run gitleaks over the checkout in its official container. --redact
          keeps detected values out of the logs and --exit-code 0 keeps this
          task green so the report, not the exit code, drives the next step.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: zricethezav/gitleaks:latest
        commands:
          - gitleaks detect --source . --no-banner --redact --report-format json
            --report-path gitleaks-report.json --exit-code 0

      - id: parse_report
        type: io.kestra.plugin.scripts.python.Script
        description: Turn the raw gitleaks JSON into a leak count plus the distinct rule
          IDs, emitted through the outputs protocol for the branch below.
        taskRunner:
          type: io.kestra.plugin.core.runner.Process
        script: |
          import json
          import os

          path = "gitleaks-report.json"
          findings = []
          if os.path.exists(path) and os.path.getsize(path) > 0:
              with open(path) as f:
                  findings = json.load(f)

          rules = sorted({f.get("RuleID", "unknown") for f in findings})
          print(f"{len(findings)} finding(s) across {len(rules)} rule(s)")
          print("::" + json.dumps({"outputs": {
              "leak_count": len(findings),
              "rules": rules,
              "rules_summary": ", ".join(rules) if rules else "n/a",
          }}) + "::")

  - id: check_findings
    type: io.kestra.plugin.core.flow.If
    description: Branch on the leak count — findings escalate everywhere, a clean
      scan just records itself.
    condition: "{{ outputs.parse_report.vars.leak_count > 0 }}"
    then:
      - id: create_issue
        type: io.kestra.plugin.github.issues.Create
        description: Open a labeled GitHub issue listing the triggered rules, so the
          leak lands in the same backlog engineers already work from.
        jwtToken: "{{ secret('GITHUB_TOKEN') }}"
        repository: "{{ inputs.repository }}"
        title: "Secrets detected in {{ inputs.repository }} by Kestra scan"
        body: |
          ## Secret scan findings

          **{{ outputs.parse_report.vars.leak_count }} finding(s)** on branch `{{ inputs.branch }}` — rules triggered: {{ outputs.parse_report.vars.rules_summary }}.

          Execution: {{ execution.id }}

          Rotate anything that was committed, scrub it from history, then close this issue.
        labels:
          - security
          - secrets
      - id: alert_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Tell the team how many leaks were found and that a GitHub issue is
          waiting.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "Secret scan found {{ outputs.parse_report.vars.leak_count }} leak(s) in {{ inputs.repository }} (branch {{ inputs.branch }}): {{ outputs.parse_report.vars.rules_summary }}. A GitHub issue has been opened — rotate anything that was committed. Execution {{ execution.id }}."
          }
      - id: fail_the_run
        type: io.kestra.plugin.core.execution.Fail
        description: Fail the execution so whatever automation watches it sees red
          instead of a quiet success.
        errorMessage: "Secret scan found {{ outputs.parse_report.vars.leak_count }}
          finding(s) in {{ inputs.repository }}."
    else:
      - id: log_clean
        type: io.kestra.plugin.core.log.Log
        description: Record the clean result so the execution history doubles as a scan
          trail.
        message: "gitleaks found no secrets in {{ inputs.repository }} (branch {{
          inputs.branch }})."

errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert when the scan itself broke — clone failure, image pull
      failure — because a dead scanner is indistinguishable from a clean
      repository.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Secret scan FAILED in flow {{ flow.id }} (execution {{ execution.id }}) — the repository was NOT checked. Verify the GITHUB_TOKEN secret and Docker access on the worker."
      }

outputs:
  - id: leak_count
    type: INT
    description: Number of secret findings in the scanned branch, e.g. 3.
    value: "{{ outputs.parse_report.vars.leak_count }}"
  - id: rules
    type: ARRAY
    description: 'Distinct gitleaks rule IDs that fired, e.g. ["aws-access-key-id",
      "generic-api-key"].'
    value: "{{ outputs.parse_report.vars.rules | toJson }}"