ci: drop the dead gitleaks PR-scan variable - #22
Merged
Conversation
✅MegaLinter analysis: Success
See detailed reports in MegaLinter artifacts
|
gwarf
changed the title
MegaLinter v10 removed REPOSITORY_GITLEAKS in favour of REPOSITORY_BETTERLEAKS and ignores variables belonging to removed linters with only a log notice, so REPOSITORY_GITLEAKS_PR_COMMITS_SCAN has had no effect since the v10 bump landed. The migration is not a rename. Setting REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN switches betterleaks from project mode to git mode, and its git mode aborts with "detected dubious ownership in repository at '/github/workspace'". Granting the exception through REPOSITORY_BETTERLEAKS_PRE_COMMANDS does not help: the pre-command runs, MegaLinter also sets safe.directory for GITHUB_WORKSPACE at startup, and betterleaks still fails, so the exception is not reaching the config the linter process reads. Verified on v9.6.0, which ships both linters side by side. Secret scanning therefore stays unscoped in project mode, which works and is what the current runs already do. Comment records the constraint so a later bump does not retry the rename.
gwarf
force-pushed
the
fix/betterleaks-pr-commits-scan
branch
from
August 20, 2026 10:45
d64325e to
3b5dcd5
Compare
gwarf
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #21, now that v10.0.0 is on
main. Removes one dead variable and records why.REPOSITORY_GITLEAKS_PR_COMMITS_SCANhas had no effect since #21 merged: v10 removedREPOSITORY_GITLEAKSin favour ofREPOSITORY_BETTERLEAKSand ignores variables of removed linters with only a log notice.The migration is not a rename. I tested
REPOSITORY_BETTERLEAKS_PR_COMMITS_SCANon v9.6.0, which ships both linters side by side:PR_COMMITS_SCANmoves betterleaks from project mode to git mode, and git mode aborts on ownership. Granting the exception throughREPOSITORY_BETTERLEAKS_PRE_COMMANDSdoes not help. The pre-command demonstrably runs:and betterleaks fails identically afterwards. MegaLinter also sets
safe.directoryforGITHUB_WORKSPACEitself at startup, so the exception is not reaching whatever config the linter process actually reads. gitleaks never had this problem on the same workspace.Adjacent open upstream issues, neither covering this case: oxsecurity/megalinter#8731 (gitleaks PR-scan docs lost in the transition) and oxsecurity/megalinter#8732 (betterleaks PR scan broken on Azure Pipelines).
Net effect: secret scanning stays unscoped in project mode. That works and is already what runs today, at the cost of scanning the whole workspace on each PR instead of only the PR commits.
.gitleaksignoreis read unchanged, so existing suppressions still apply.The comment exists so a later bump does not retry the rename and rediscover this.