action.yml

name: 'Secret Scanner'
author: 'GarnerCorp'
description: 'Scan for secrets in a repository'
branding:
  icon: 'eye'
  color: 'orange'

inputs:
  detect_secrets_version:
    description: 'The version of Yelp/detect-secrets to use'
    required: false
    default: '1.3.0'
  detect_secret_additional_args:
    description: 'Extra arguments to pass to the detect-secret binary'
    required: false
    default: ''
  baseline_file:
    description: "A path to the baseline secrets file"
    required: false
    default: .secrets.baseline
  python_version:
    description: "The version of python to use"
    required: false
    default: '3.10.4'
  exclude_files_path:
    description: "A path to the files containing things to exclude"
    required: false
    default: ".github/actions/secret-scanner"

runs:
  using: 'composite'
  steps:
    - name: Set-up python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ inputs.python_version }}
    - name: Install detect-secrets
      shell: bash
      run: pip install detect-secrets[gibberish]=="$DETECT_SECRET_VERSION"
      env: 
        DETECT_SECRET_VERSION: ${{ inputs.detect_secrets_version }}
    - name: Check for secrets
      shell: bash
      run: $GITHUB_ACTION_PATH/detect-new-secrets.sh
      env:
        BASELINE_FILE: ${{ inputs.baseline_file }}
        DETECT_SECRET_ADDITIONAL_ARGS: ${{ inputs.detect_secret_additional_args }}
        EXCLUDE_FILES_PATH: ${{ inputs.exclude_files_path }}/excluded_files.patterns
        EXCLUDE_SECRETS_PATH: ${{ inputs.exclude_files_path }}/excluded_secrets.patterns
        EXCLUDE_LINES_PATH: ${{ inputs.exclude_files_path }}/excluded_lines.patterns