GitLeaks is erroring on an unsafe repository #846
Description
Describe the bug
Since upgrading to GitLeaks 8.7+, running GitLeaks on CI gets the following error:
v8.7.1: Pulling from zricethezav/gitleaks
a0d0a0d46f8b: Pulling fs layer
c5009b1581c7: Pulling fs layer
49809964c881: Pulling fs layer
a0d0a0d46f8b: Verifying Checksum
a0d0a0d46f8b: Download complete
49809964c881: Verifying Checksum
49809964c881: Download complete
c5009b1581c7: Verifying Checksum
a0d0a0d46f8b: Pull complete
c5009b1581c7: Pull complete
49809964c881: Pull complete
Digest: sha256:3215af553cbb25a8f037549c1ed70364c
Status: Downloaded newer image for zricethezav/gitleaks:v8.7.1
○
│╲
│ ○
○ ░
░ gitleaks
4:52PM ERR fatal: unsafe repository ('/app' is owned by someone else)
4:52PM ERR To add an exception for this directory, call:
4:52PM ERR
4:52PM ERR git config --global --add safe.directory /app
This is easily fixed by inserting that suggested line into our CI files:
cd /app
git config --global --add safe.directory /app
gitleaks detect --verbose --source='./' --config='.github/workflows/config.toml' --log-opts='^origin/main ${{ github.SHA }}'But I didn't see anything in the documentation about intentional changes to gitleaks that would cause this. So, I wanted to bring awareness to it just in case nobody knew this was coming up. So far, I've run into this issue with all of my GitLab pipelines and all of my GitHub workflows.
To Reproduce
Here's what my CI workflow looked like when it was breaking:
jobs:
gitleaks:
if: github.EVENT_NAME == 'pull_request'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
fetch-depth: 0
- run: |
curl -H "Accept: application/vnd.github.v3.raw" \
-L "https://api.github.com/repos/zricethezav/gitleaks/contents/config/gitleaks.toml?ref=${{ env.GITLEAKS_VERSION }}" \
>> ${{ github.WORKSPACE }}/.github/workflows/config.toml
if [[ ${{ github.REF }} == 'refs/heads/main' ]]; then
CURRENT_COMMIT="${{ github.SHA }}"
else
CURRENT_COMMIT="${{ github.EVENT.PULL_REQUEST.HEAD.SHA }}"
fi
echo "LOG_OPTS='^origin/main $CURRENT_COMMIT'" >> $GITHUB_ENV
- uses: addnab/docker-run-action@v3
with:
image: zricethezav/gitleaks:${{ env.GITLEAKS_VERSION }}
options: -v ${{ github.WORKSPACE }}:/app
run: |
cd /app
gitleaks detect --verbose --source='./' --config='.github/workflows/config.toml' --log-opts=${{ env.LOG_OPTS }}You should be able to just create a new workflow with this code, and be able to see it throwing that error above.
Expected behavior
The scan works as expected without needing to specify the git directory is safe:
v8.7.1: Pulling from zricethezav/gitleaks
a0d0a0d46f8b: Pulling fs layer
c5009b1581c7: Pulling fs layer
49809964c881: Pulling fs layer
a0d0a0d46f8b: Verifying Checksum
a0d0a0d46f8b: Download complete
49809964c881: Verifying Checksum
49809964c881: Download complete
c5009b1581c7: Verifying Checksum
c5009b1581c7: Download complete
a0d0a0d46f8b: Pull complete
c5009b1581c7: Pull complete
49809964c881: Pull complete
Digest: sha256:3215af553cbb25a8f037549c1ed70364c
Status: Downloaded newer image for zricethezav/gitleaks:v8.7.1
○
│╲
│ ○
○ ░
░ gitleaks
5:02PM INF scan completed in 54.910108ms
5:02PM INF no leaks found
Screenshots
If applicable, add screenshots to help explain your problem.
Basic Info (please complete the following information):
- OS:
- Gitleaks Version:
Additional context
Add any other context about the problem here.
cc @zricethezav