feat(gitleaks): test

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions: write-all
 
     strategy:
       matrix:
@@ -20,6 +21,9 @@ jobs:
     - uses: gitleaks/gitleaks-action@v2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false'
+        GITLEAKS_VERSION: '8.28.0'
+        GITLEAKS_LOG_LEVEL: 'trace'
 
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v4

.gitleaks.toml

@@ -0,0 +1,21 @@
+title = "Custom Gitleaks Config for GC Secrets"
+
+# Extend the default gitleaks config to keep all standard rules
+[extend]
+useDefault = true
+
+# Any line with gc_client_id and a value
+[[rules]]
+id = "gc-client-id-any"
+description = "Any line with gc_client_id and a value"
+regex = '''(?i)gc_client_id.*[:=].*\S+'''
+keywords = ["gc_client_id"]
+tags = ["gc", "client", "id"]
+
+# Any line with gc_client_secret and a value
+[[rules]]
+id = "gc-client-secret-any"
+description = "Any line with gc_client_secret and a value"
+regex = '''(?i)gc_client_secret.*[:=].*\S+'''
+keywords = ["gc_client_secret"]
+tags = ["gc", "client", "secret"]

src/handler.ts

@@ -62,7 +62,7 @@
     queryStringParameters: null,
     multiValueQueryStringParameters: null,
     stageVariables: null,
     requestContext: {} as any,
     resource: '/test'
   };
 
@@ -70,7 +70,7 @@
     clientContext: {
       gc_client_id: '',
       gc_client_secret: '',
-      gc_aws_region: 'us-east-1'
+      gc_aws_region: '',
     }
   };