gitsecrets.yml

name: GitSecretsScan

on: [push, pull_request]

jobs:
  git-secret-check:
    name: Git Secrets Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          path: src/github.com/aws/amazon-ecs-ami
      - name: Git Secrets Scan Script
        run: |
          # workaround git-secrets requiring the say command: https://github.com/awslabs/git-secrets/pull/221
          ln -s "$(which echo)" /usr/local/bin/say
          set -ex
          cd $GITHUB_WORKSPACE
          git clone https://github.com/awslabs/git-secrets.git && cd git-secrets
          sudo make install
          git secrets --register-aws --global
          cd $GITHUB_WORKSPACE/src/github.com/aws/amazon-ecs-ami
          git secrets --install
          git secrets --register-aws
          git secrets --scan-history