Gitleaks in Woodpecker — Catch Secrets Before They Ship
Lint and TypeScript build catch broken code. They do not catch an API token that landed in a commit six months ago. Self-hosted pipelines still need secret scanning — and the scan has to run before deploy, not as an optional afterthought.
In .woodpecker.yml, a gitleaks step runs gitleaks detect against the repo with scripts/gitleaks.toml. It writes a JSON report and an ok/fail flag. A later security-gate step reads that flag and fails the pipeline if secrets were found.
The Woodpecker article covers install → lint → build → QA → SFTP. Gitleaks sits at the front of that story: if history is dirty, nothing else matters until you fix it.