GitHub Actions
#
PreludeGitGuardian CI/CD integration with GitHub comes in the form of GitHub Actions and is performed through our CLI application ggshield. ggshield is a wrapper around the GitGuardian API for secrets detection, an API key is required for authentication.
The ggshield-action repository and starter templates are available on GitHub.
#
PreviewIf there are secret leaks or other security issues in your commit, your workflow will be marked as failed.
Be sure to add GitGuardian scan
to your required status checks in your repository settings to stop pull requests with security issues from being merged.
#
InstallationService accounts are recommended to run this integration.
Please note that service accounts are only available for workspaces under our Business plan, and their administration is restricted to Managers. If your workspace is under the Free plan, you can still use a personal access token to run this integration.
- Create a service account from the API section of your GitGuardian workspace (or a personal access token if you are on the Free plan).
- Add this API key to the
GITGUARDIAN_API_KEY
environment variable in your project settings. You can set theGITGUARDIAN_API_KEY
value in the "Secrets" page of your repository's settings. - Add a new job to your GitHub workflow using the GitGuardian/ggshield-action action
.github/workflows/gitguardian
.
name: GitGuardian scan
on: [push, pull_request]
jobs: scanning: name: GitGuardian scan runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 with: fetch-depth: 0 # fetch all history so multiple commits can be scanned - name: GitGuardian scan uses: GitGuardian/ggshield-action@master env: GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }} GITHUB_PUSH_BASE_SHA: ${{ github.event.base }} GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }} GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
You may be interested in using GitGuardian's GitHub integration to ensure full coverage of your GitHub repositories as well as full git history scans and reporting.