[rhoai-3.3] RHAIENG-5305, RHAIENG-5303: fix(cve): CVE-2026-44432, CVE-2026-44431 - update urllib3 to 2.7.0 #1688
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Gitleaks | |
| "on": | |
| push: | |
| branches: | |
| - main | |
| - stable | |
| - 'rhoai-*' | |
| pull_request: | |
| schedule: | |
| - cron: '0 4 * * 3' | |
| workflow_dispatch: | |
| concurrency: | |
| group: gitleaks-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| scan: | |
| name: Gitleaks secret scan | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install Gitleaks | |
| uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3 | |
| with: | |
| # mise_toml (not install_args) so the tool is both installed and | |
| # activated; install_args only runs `mise install` which leaves the | |
| # shim unresolved ("No version is set for shim: gitleaks"). | |
| # language=TOML | |
| mise_toml: | | |
| [tools] | |
| "github:gitleaks/gitleaks" = "8.30.1" | |
| - name: Run Gitleaks | |
| id: run-gitleaks | |
| # Exit code 0: no leaks, 1: leaks found. Don't fail the job on | |
| # findings -- the SARIF upload feeds GitHub code scanning which | |
| # handles baseline comparison and only alerts on net-new leaks. | |
| run: gitleaks git --config .gitleaks.toml --report-format sarif --report-path gitleaks.sarif --no-banner --exit-code 0 | |
| - name: Sanitize Gitleaks SARIF for upload | |
| id: sanitize-gitleaks-sarif | |
| # Run when Gitleaks produced a report (success or failure), not on cancel or if scan was skipped. | |
| # Outcome check keeps this working if we later drop --exit-code 0 and fail the step on findings. | |
| if: ${{ !cancelled() && (steps.run-gitleaks.outcome == 'success' || steps.run-gitleaks.outcome == 'failure') }} | |
| # Gitleaks can emit endColumn=0; upload-sarif rejects that (needs endColumn >= 1). | |
| # See scripts/ci/sanitize_gitleaks_sarif.py and docs/sarif.md. | |
| run: python3 scripts/ci/sanitize_gitleaks_sarif.py gitleaks.sarif | |
| - name: Upload SARIF | |
| # Do not upload on cancel or when scan/sanitize did not produce a valid SARIF. | |
| if: ${{ !cancelled() && steps.sanitize-gitleaks-sarif.outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} | |
| uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| sarif_file: gitleaks.sarif |