security.yaml

name: security
on: [pull_request]
jobs:
  truffelhog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0
      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@v3.10.3
        with:
          path: ./
          base: ${{ github.event.pull_request.head.ref }}
          head: ${{ github.event.pull_request.head.sha }}
          extra_args: --debug
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  yaml-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Get specific changed files
        id: changed-cicd
        uses: tj-actions/changed-files@v28.0.0
        with:
          json: "true"
          files: |
            cicd/**
      - uses: stefanprodan/kube-tools@v1
        if: steps.changed-cicd.outputs.any_changed == 'true'
        with:
          command: |
            find cicd -type f -name '*.yaml' -print0 | while IFS= read -r -d $'\0' file; do 
            echo check $file;
            yq e 'true' "$file" > /dev/null
            done