From 9b5788ad9d33640d3407a1573e0d1961895d416b Mon Sep 17 00:00:00 2001
From: Simon Cornet <simon@simoncor.net>
Date: Fri, 6 Jun 2025 17:22:46 +0200
Subject: [PATCH] feat(ci): add gitleaks

---
 .gitlab-ci.yml        |  2 ++
 .gitlab/gitleaks.yaml | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 .gitlab/gitleaks.yaml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5d82fc7..fdb0b13 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,6 +4,7 @@
 stages:
 
   # deployment
+  - "gitleaks"
   - "linting"
   - "deployment"
 
@@ -12,5 +13,6 @@ stages:
 include:
 
   # deployment
+  - local: ".gitlab/gitleaks.yaml"
   - local: ".gitlab/linting.yaml"
   - local: ".gitlab/deployment.yaml"
diff --git a/.gitlab/gitleaks.yaml b/.gitlab/gitleaks.yaml
new file mode 100644
index 0000000..e2b3247
--- /dev/null
+++ b/.gitlab/gitleaks.yaml
@@ -0,0 +1,18 @@
+---
+
+# gitleaks
+gitleaks:
+  stage: "gitleaks"
+  image:
+    name: "ghcr.io/gitleaks/gitleaks:latest"
+  variables:
+    GIT_DEPTH: 1
+  rules:
+
+    # run only on push to default branch
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - when: "never"
+
+  # start linting
+  script:
+    - "gitleaks detect --source . --verbose --redact --max-decode-depth 1"