name: "Gitleaks"

on:
  workflow_call:
    inputs:
      head_sha:
        required: true
        type: string
      base_sha:
        required: true
        type: string
      version:
        required: false
        type: string
        default: "latest"

env:
  ACTIONS_STEP_DEBUG: '${{ secrets.ACTIONS_STEP_DEBUG }}'


jobs:
  gitleaks:
    name: "Gitleaks"
    runs-on: ubuntu-latest
    steps:
      - uses: hmarr/debug-action@v3.0.0

      - name: install
        shell: bash
        run: |
          set -euo pipefail
          arch="$(uname)_$(uname -m)"
          platform=$(echo $arch | tr '[:upper:]' '[:lower:]' )
          echo "PLATFORM=$platform" >> $GITHUB_ENV
          if [[ "${{ inputs.version }}" == "latest" ]]; then
            echo "GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r .tag_name | sed 's/^v//')" >> $GITHUB_ENV
          else
            echo "GITLEAKS_VERSION=${{ inputs.version }}" >> $GITHUB_ENV
          fi

      - name: Cache gitleaks archive
        id: cache_gitleaks
        uses: actions/cache@v5
        with:
          path: /usr/local/bin/gitleaks
          key: gitleaks-${{ env.PLATFORM }}-${{ env.GITLEAKS_VERSION }}

      - name: Download and configure gitleaks
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${{ steps.cache_gitleaks.outputs.cache-hit }}" != "true" ]]; then
            DOWNLOAD_URL="https://github.com/gitleaks/gitleaks/releases/download/v${{ env.GITLEAKS_VERSION }}/gitleaks_${{ env.GITLEAKS_VERSION }}_linux_x64.tar.gz"
            echo "Download Gitleaks ${{ env.GITLEAKS_VERSION }} for ${{ env.PLATFORM }} from ${DOWNLOAD_URL}"
            curl -fsSL "$DOWNLOAD_URL" | tar xzf - -C /usr/local/bin
          fi
          chmod +x /usr/local/bin/gitleaks

      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 2147483647
          ref: ${{ inputs.head_sha }}

      - name: Run gitleaks
        run: |
          set -euo pipefail ${ACTIONS_STEP_DEBUG:+-x}

          gitleaks \
            detect \
            --source="." \
            --redact \
            -v \
            --exit-code=2 \
            --report-format=sarif \
            --report-path=results.sarif \
            --log-level=debug \
            --log-opts='${{ inputs.base_sha }}..${{ inputs.head_sha }}'

      - name: Upload test results
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: GitLeaks results
          path: results.sarif