Hardening CI with Gitleaks — Secrets Scanning in Woodpecker
Secret leakage is one of the most prevalent and damaging security incidents in software development. An engineer accidentally commits a private key, database password, or API token, and within minutes, automated web scrapers exploit the credential. Code linters and compilers do not detect secrets; dedicated static analysis is required.
In our self-hosted Woodpecker CI pipeline, Gitleaks runs as an unskippable security gate on every single push and pull request. It analyzes commit diffs and historical objects before build or deployment steps can ever execute.
Many secret scanners only inspect the current files checked out in the working tree. This creates a dangerous false sense of security. If a developer accidentally commits a secret, deletes it in the next commit, and pushes both commits, a working-tree scanner will report zero findings.