8000 chore(secret-leak): bump betterleaks to v1.9.0 by dkastl · Pull Request #156 · geolonia/.github · GitHub
[go: up one dir, main page]
Skip to content

chore(secret-leak): bump betterleaks to v1.9.0 - #156

Merged
dkastl merged 2 commits into
mainfrom
chore/betterleaks-1.9.0
Oct 18, 2026
Merged

chore(secret-leak): bump betterleaks to v1.9.0#156
dkastl merged 2 commits into
mainfrom
chore/betterleaks-1.9.0

Conversation

@dkastl
@dkastl dkastl commented Oct 18, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Contributor

Bumps the betterleaks image used by reusable-secret-leak-check.yml from v1.8.1 to v1.9.0 (released 2026-09-29), and moves the pre-commit example to the same version. The example says to bump both together, but it had stayed on v1.6.1.

  • New pin: ghcr.io/betterleaks/betterleaks@sha256:e3b95b0d...6cac, the multi-arch index digest (linux/amd64 + linux/arm64), read from the GHCR manifest API. The same lookup reproduces the current v1.8.1 pin exactly.
  • betterleaks-docker hook id still exists at v1.9.0.

What changes in v1.9.0

  • 46 new detection rules (Miro, VoyageAI, Bitbucket Data Center, ...), fewer false positives, lower memory use.
  • A clean scan writes [] instead of null. The "Parse findings" step already accepts both (null -> 0, array -> length).
  • "Removed internal attributes from reports": checked, none of the fields this workflow reads are affected.

Verification (local, Docker, org base .betterleaks.toml)

Fixture v1.8.1 v1.9.0
Planted GitHub PAT + Slack bot token 2 findings: github-pat, slack-bot-token identical
Clean repo null []

Top-level keys and Attributes keys (path, git.sha, git.author_name, git.date, ...) are identical between the two versions, with exit code 0 in every run.

Callers SHA-pin this reusable workflow, so they pick up the new image when they bump their ref.

Summary by CodeRabbit

  • Chores
    • Updated secret-scan validation to recognize clean results in both the current and previously used output formats, while continuing to count reported findings accurately. The example pre-commit setup is also aligned with the current scan configuration. These changes affect automated checks and setup examples; they do not change application behavior or add user-facing features.

@coderabbitai
coderabbitai Bot commented Oct 18, 2026 •
edited
Loading
Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository YAML (base), Central YAML (inherited)
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: 5ec3caf7-558e-4397-af7f-17732ffe7ebf
📥 Commits

Reviewing files that changed from the base of the PR and between bc2c43e and 194c1fe.

📒 Files selected for processing: 2
  • .github/workflows/reusable-secret-leak-check.yml
  • betterleaks/.pre-commit-config.example.yaml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The default workflow image and example pre-commit revision now use Betterleaks v1.9.0. Workflow comments describe empty-array output for clean scans and continued acceptance of null from versions through v1.8.x.

Changes: Betterleaks version update

Layer / File(s) Summary
Version pins and output compatibility
.github/workflows/reusable-secret-leak-check.yml, betterleaks/.pre-commit-config.example.yaml		 The workflow image and example pre-commit revision use v1.9.0. Workflow comments describe empty-array output for clean scans and continued acceptance of null from versions through v1.8.x.

Priority: ⬇️ Low

Change: Other

Merge Risk: ⚪ Minimal · up to 194c1

The update uses Betterleaks v1.9.0 while retaining compatibility with the earlier null output and the new empty-array output; no material merge-blocking risk is evident.

Pre-merge checks: Passed 5
Check name Status Explanation
Description check Passed The description clearly explains the Betterleaks version update, affected files, behavior changes, verification results, and workflow impact. The optional checklist is omitted, and no Related Issues s…
Title check Passed The title clearly and concisely identifies the Betterleaks version bump and matches the main change in the pull request.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description clearly explains the Betterleaks version update, affected files, behavior changes, verification results, and workflow impact. The optional checklist is omitted, and no Related Issues section is provided, but the description is otherwise complete and on topic.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@github-actions
github-actions Bot commented Oct 18, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

🛡️ Security suite

Check Result
✅ Supply chain · bumblebee No exposure matches
✅ Secrets · betterleaks No secrets in diff
✅ Action pinning · pinact All actions pinned
✅ Actions audit · zizmor No findings

Note

All security checks passed.

Updated for 194c1fe · workflow run

@dkastl
dkastl marked this pull request as ready for review October 18, 2026 19:16
@dkastl
dkastl merged commit 259f87e into main Oct 18, 2026
6 checks passed
@dkastl
dkastl deleted the chore/betterleaks-1.9.0 branch October 18, 2026 19:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dkastl
0