Secret scan: hold the install step and the checkout's version, not only the scan #146

Activity

1. don-petry commented on Oct 17, 2026

   

   don-petry

   on Oct 17, 2026

   ContributorAuthor

   More actions

   Working rulings (overturnable in review)

   Solution Architect, delegated. On main at bd18750.

   Both gaps are real, and today only the EXEMPT hash and the model review of .github/ close them. scan_problems should hold the scan on its own, with the hash as a second wall.

   1. The install's whole block is held exactly.

   • INSTALL_RUN, beside SCAN_RUN, is the install's six lines as they stand. Any other block is a problem of its own. It replaces the check that the install names no base, which it covers.
   • The block reads ${GITLEAKS_VERSION} and ${GITLEAKS_CHECKSUM}, so the values are free while the block is not.
   • Each value is held to its shape, quoted: the version "N.N.N", the checksum 64 lowercase hex. The version's shape matters: it goes into the URL's path, and curl folds /../, so a free version could fetch another repository's release.
   • The URL, --proto '=https' and sha256sum -c are held. A free checksum can only accept what a gitleaks release serves. Whether it is the right one is the reviewer's, as on any bump.
   • No floor on the version. A gitleaks without a flag of SCAN_RUN exits non-zero, and the scan fails closed. The hash still names the exact version.

   2. Every checkout is the listed one, not "the one pinned elsewhere".

   • "Pinned elsewhere" has no fixed point: one change that moves every checkout moves what they are compared with. PIN makes pins equal in both word-for-word comparisons, so nothing else holds them.
   • CHECKOUT in check_workflows.py names the commit and its version, 3d3c42e5… # v7.0.1.
   • It is held in lint, under the pin rule, for every actions/checkout in every workflow. verify's base checkout needs ref: as the scan's does.
   • Other actions keep any looked-up pin. Only checkout's ref: and path: carry a rule here.

   3. Tests and mutants.

   • Counter-cases: a stub install (printf 'exit 0' | sudo tee /usr/local/bin/gitleaks), a line added, a version with /../, a checksum not hex, and a v2.7.0 checkout pin in ci.yml and in verify.yml's base checkout.
   • examples/workflows/invalid/pin.a-checkout-not-the-listed-one.yml breaks pin alone.
   • Mutants: the block comparison off, each shape check off, the listed-pin comparison off. "The secret scan's install may write to base/" goes with its line.

   4. No decision 0031. Decision 0023 already says the base is checked out "by the same pinned actions/checkout", and that the install names no base. This holds what it says. 0023 gains two Boundary rows, which check_decisions allows, and docs/standards/workflows.md a sentence under "Pinned to what was looked up".

   Taken as working rulings (the Maintainer may overturn them in review)

   • An actions/checkout bump must also edit the listed pin (CHECKOUT), so a bot's bump can't merge on its own. It touches .github/, so it needs the model review in any case (decision 0020).
2. don-petry

   closed this as completedin #151on Oct 18, 2026