@@ -60,7 +60,16 @@ Once the secrets have been rotated or confirmed as false positives, you can mark
## Choose engine `gitleaks` or `betterleaks`
Just choose the Docker image in the config below
Just provide a Docker image with the `gitleaks` or `betterleaks` installed. If both are available, the new `betterleaks` tool take priority.
To choose define `image`:
- Gitleaks: keep the default Docker image below
- betterleaks: use offical Docker image `ghcr.io/betterleaks/betterleaks:latest`
While maintaining full compatibility, `betterleaks` offers significant performance gains, including faster processing, increased scanning capacity, and more efficient detection algorithms.
| `image` / `GITLEAKS_IMAGE` | The Docker image used to run Gitleaks / betterleaks | `docker.io/zricethezav/gitleaks:latest`<br/>[](https://to-be-continuous.gitlab.io/doc/secu/trivy-GITLEAKS_IMAGE) <br/>`ghcr.io/betterleaks/betterleaks:latest`<br/>[](https://to-be-continuous.gitlab.io/doc/secu/trivy-BETTERLEAKS_IMAGE) |
| `image` / `GITLEAKS_IMAGE` | The Docker image used to run Gitleaks / betterleaks | `docker.io/zricethezav/gitleaks:latest`<br/>[](https://to-be-continuous.gitlab.io/doc/secu/trivy-GITLEAKS_IMAGE) |
| `rules` / `GITLEAKS_RULES` | Gitleaks [configuration rules](https://github.com/zricethezav/gitleaks#configuration) to use (you may also provide your own `.gitleaks.toml` configuration file in your project). | _none_ (uses default rules) |
| `args` / `GITLEAKS_ARGS` | [Options](https://github.com/zricethezav/gitleaks/wiki/Options) for a full Gitleaks analysis (on master or develop branches) | `--verbose --redact` |
@@ -83,9 +92,9 @@ In addition to a textual report in the console, this job produces the following
Here is how this GitLab CI template chooses the Gitleaks rules to use:
1. It first looks for a `.gitleaks.toml` file at the root of your project repository.
2. If not found, it uses the `.toml` file specified with the `$GITLEAKS_RULES` variable.
3. If not specified, [default Gitleaks rules](https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml) are used.
1. It first looks for a `.betterleaks.toml` file at the root of your project repository.
2. It first looks for a `.gitleaks.toml` file at the root of your project repository.
3. If not found, it uses the `.toml` file specified with the `$GITLEAKS_RULES` variable.
4. If not specified, [default Gitleaks rules](https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml) are used.
Your Gitleaks rule file can extend the default rules by using `[extend]` + `useDefault = true` as explained in the [Gitleaks documentation](https://github.com/gitleaks/gitleaks/blob/master/README.md#configuration)
Your Gitleaks rule file can extend the default rules by using `[extend]` + `useDefault = true` as explained in the [Gitleaks documentation](https://github.com/gitleaks/gitleaks/blob/master/README.md#configuration) or [betterleaks documentation](https://github.com/betterleaks/betterleaks?tab=readme-ov-file#configuration).