Commit 2b5a0eda authored by Gaëtan Montury's avatar Gaëtan Montury
Browse files

fix: also catch the custom betterlieks config file and improve README

parent e32c1a8a
Loading
Loading
Loading
Loading
+16 −7
Original line number Diff line number Diff line
@@ -60,7 +60,16 @@ Once the secrets have been rotated or confirmed as false positives, you can mark

## Choose engine `gitleaks` or `betterleaks`

Just choose the Docker image in the config below
Just provide a Docker image with the `gitleaks` or `betterleaks` installed. If both are available, the new `betterleaks` tool take priority. 

To choose define `image`:
- Gitleaks: keep the default Docker image below 
- betterleaks: use offical Docker image `ghcr.io/betterleaks/betterleaks:latest`

While maintaining full compatibility, `betterleaks` offers significant performance gains, including faster processing, increased scanning capacity, and more efficient detection algorithms.

- betterleaks [usage docs](https://github.com/betterleaks/betterleaks?tab=readme-ov-file#usage)
- Gitleaks [usage docs](https://github.com/gitleaks/gitleaks?tab=readme-ov-file#usage)

## `gitleaks` jobs configuration

@@ -69,7 +78,7 @@ They use the following configuration.

| Input / Variable | Description                            | Default value     |
| --------------------- | -------------------------------------- | ----------------- |
| `image` / `GITLEAKS_IMAGE` | The Docker image used to run Gitleaks / betterleaks  | `docker.io/zricethezav/gitleaks:latest` <br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-GITLEAKS_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-GITLEAKS_IMAGE) <br/> `ghcr.io/betterleaks/betterleaks:latest` <br/> [![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-BETTERLEAKS_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-BETTERLEAKS_IMAGE) |
| `image` / `GITLEAKS_IMAGE` | The Docker image used to run Gitleaks / betterleaks  | `docker.io/zricethezav/gitleaks:latest` <br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-GITLEAKS_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-GITLEAKS_IMAGE) |
| `rules` / `GITLEAKS_RULES` | Gitleaks [configuration rules](https://github.com/zricethezav/gitleaks#configuration) to use (you may also provide your own `.gitleaks.toml` configuration file in your project). | _none_ (uses default rules) |
| `args` / `GITLEAKS_ARGS` | [Options](https://github.com/zricethezav/gitleaks/wiki/Options) for a full Gitleaks analysis (on master or develop branches) | `--verbose --redact` |

@@ -83,9 +92,9 @@ In addition to a textual report in the console, this job produces the following

Here is how this GitLab CI template chooses the Gitleaks rules to use:

1. It first looks for a `.gitleaks.toml` file at the root of your project repository.
2. If not found, it uses the `.toml` file specified with the `$GITLEAKS_RULES` variable.
3. If not specified, [default Gitleaks rules](https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml) are used.

1. It first looks for a `.betterleaks.toml` file at the root of your project repository.
2. It first looks for a `.gitleaks.toml` file at the root of your project repository.
3. If not found, it uses the `.toml` file specified with the `$GITLEAKS_RULES` variable.
4. If not specified, [default Gitleaks rules](https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml) are used.

Your Gitleaks rule file can extend the default rules by using `[extend]` + `useDefault = true` as explained in the [Gitleaks documentation](https://github.com/gitleaks/gitleaks/blob/master/README.md#configuration)
Your Gitleaks rule file can extend the default rules by using `[extend]` + `useDefault = true` as explained in the [Gitleaks documentation](https://github.com/gitleaks/gitleaks/blob/master/README.md#configuration) or [betterleaks documentation](https://github.com/betterleaks/betterleaks?tab=readme-ov-file#configuration).
+4 −1
Original line number Diff line number Diff line
@@ -219,7 +219,10 @@ stages:
  }

  function install_gitleaks_rules() {
    if [[ -f ".gitleaks.toml" ]]
    if [[ -f ".betterleaks.toml" ]]
    then
      log_info "Using custom betterleaks rules from project (\\e[33;1m.betterleaks.toml\\e[0m)"
    elif [[ -f ".gitleaks.toml" ]]
    then
      log_info "Using custom Gitleaks rules from project (\\e[33;1m.gitleaks.toml\\e[0m)"
    elif [[ "$GITLEAKS_RULES" ]]