Scan only PR commits for Gitleaks instead of whole codebase

[DariuszPorowski]

Is your feature request related to a problem? Please describe.

Scan only PR commits for Gitleaks instead of whole codebase, when VALIDATE_ALL_CODEBASE is set to false

Describe the solution you'd like

When VALIDATE_ALL_CODEBASE is set to false, and megalinter runs on PR then Gitleaks scans only PR commits.

Describe alternatives you've considered

Described scenarios is achievable by passing REPOSITORY_GITLEAKS_ARGUMENTS env contains gitleaks flag --log-opts, but nice to have out-of-the-box support (using VALIDATE_ALL_CODEBASE) without extra configuration.

- name: MegaLinter
  if: ${{ github.event_name == 'pull_request' }}
  id: megalinter
  uses: oxsecurity/megalinter/flavors/documentation@v6
  env:
    VALIDATE_ALL_CODEBASE: false
    REPOSITORY_GITLEAKS_ARGUMENTS: --log-opts '--no-merges --first-parent ${{ github.event.pull_request.base.sha }}^..${{ github.event.pull_request.head.sha }}'

Downside - to scan only PR commits with proposed gitleaks config, git checkout has to be set with fetch-depth: 0

- name: Checkout
  uses: actions/checkout@v3
  with:
    fetch-depth: 0

Additional context

N/A

[nvuillam]

That could be doable here -> https://github.com/oxsecurity/megalinter/blob/main/megalinter/linters/GitleaksLinter.py

Before the call to cmd = super().build_lint_command(file), do something like:

if config.get("VALIDATE_ALL_CODEBASE", "true") == "false":
    self.cli_lint_extra_args +=  ['--log-opts', '--no-merges', '--first-parent', '${{ github.event.pull_request.base.sha }}^..${{ github.event.pull_request.head.sha }}']

(GitHub Actions variables should be replaced by appropriate ENV vars.)

Would you like to make a PR ? :)

[bdovaz]

@nvuillam but we have to take into account other CI like Azure Pipelines, in the linter script we can't hardcode those variables that only exist in GitHub.

[DariuszPorowski]

@nvuillam @bdovaz already working on PR and conditions for multi-orchestrators + local executions are on my todo list.

[nvuillam]

@bdovaz indeed :)

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this issue should stay open, please remove the O: stale 🤖 label or comment on the issue.

[DariuszPorowski]

wip #2504