Gitleaks GitHub Action Rule

rule-types/github/gitleaks_github_action.test.yaml

@@ -0,0 +1,13 @@
+tests:
+  - name: "Should have Gitleaks enabled"
+    def: {}
+    params: {}
+    expect: "pass"
+    git:
+      repo_base: github_action_with_gitleaks
+  - name: "Should not have Gitleaks enabled"
+    def: {}
+    params: {}
+    expect: "fail"
+    git:
+      repo_base: github_action_without_gitleaks

rule-types/github/gitleaks_github_action.testdata/github_action_with_gitleaks/gitleaks.yaml

@@ -0,0 +1,14 @@
+name: gitleaks
+on:
+  workflow_dispatch:
+  schedule:
+    # Run every 15 minutes
+    - cron: '0/15 * * * *'
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+      - name: Self-hosted Gitleaks
+        uses: gitleaks/gitleaks-action@v2

rule-types/github/gitleaks_github_action.testdata/github_action_without_gitleaks/not-gitleaks.yaml

@@ -0,0 +1,12 @@
+name: Just Checkout
+on:
+  workflow_dispatch:
+  schedule:
+    # Run every 15 minutes
+    - cron: '0/15 * * * *'
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]

rule-types/github/gitleaks_github_action.yaml

@@ -0,0 +1,43 @@
+---
+version: v1
+release_phase: alpha
+type: rule-type
+name: gitleaks_github_action
+display_name: Enable Gitleak to prevent leakage of passwords or keys
+short_failure_message: Gitleak is not configured via a GitHub action
+severity:
+  value: medium
+context: {}
+description: |
+  Verifies that Gitleak is configured via a GitHub action for the repository.
+guidance: |
+  Ensure that Gitleak is configured and enabled for the repository.
+  Gitleaks is an open-source secret scanner for git repositories, files, and directories.
+  For more information, see the [GitHub Action Gitleaks](https://github.com/gitleaks/gitleaks-action) documentation.
+def:
+  in_entity: repository
+  rule_schema:
+    type: object
+    properties: {}
+  ingest:
+    type: git
+    git: {}
+  eval:
+    type: rego
+    rego:
+      type: deny-by-default
+      def: |
+        package minder
+
+        import rego.v1
+
+        actions := github_workflow.ls_actions("./.github/workflows")
+
+        default message := "Gitleaks GitHub action is not configured"
+        default allow := false
+        allow if contains(actions[_], "gitleaks/gitleaks-action")
+
+  # Defines the configuration for alerting on the rule
+  alert:
+    type: security_advisory
+    security_advisory: {}