Skip to content

fix(container): install gitleaks from release binaries on multi-arch CI #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matthew-on-git merged 1 commit into from
Sep 1, 2026
Merged

fix(container): install gitleaks from release binaries on multi-arch CI #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Fixed

- Install gitleaks from official release binaries (linux amd64/arm64) instead
of `go install` under QEMU, which failed the 2026-08-31 multi-arch scheduled
build (run 33391871123, issue #60). Checksums are verified against the
upstream release `checksums.txt`.

## [1.12.10] - 2026-07-30

### Added
Expand Down
23 changes: 20 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,27 @@ RUN go install github.com/terraform-linters/tflint@latest
# Install terraform-docs
RUN go install github.com/terraform-docs/terraform-docs@latest

# Install gitleaks (pin version + inject via ldflags so `gitleaks version` reports correctly)
# Install gitleaks from official release binaries.
# Compiling via `go install` under QEMU for linux/arm64 OOMs/fails the
# multi-arch GHCR build (2026-08-31 run 33391871123 / issue #60). Official
# binaries are already version-stamped; checksums come from the release.
ARG GITLEAKS_VERSION=v8.30.0
RUN go install -ldflags "-X github.com/zricethezav/gitleaks/v8/version.Version=${GITLEAKS_VERSION}" \
github.com/zricethezav/gitleaks/v8@${GITLEAKS_VERSION}
RUN set -eux; \
case "${TARGETARCH}" in \
amd64) _arch=x64 ;; \
arm64) _arch=arm64 ;; \
*) echo "unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
esac; \
_ver="${GITLEAKS_VERSION#v}"; \
_base="https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}"; \
_tar="gitleaks_${_ver}_linux_${_arch}.tar.gz"; \
mkdir -p /go/bin; \
curl -fsSL -o "/tmp/${_tar}" "${_base}/${_tar}"; \
curl -fsSL -o /tmp/gitleaks_checksums.txt "${_base}/gitleaks_${_ver}_checksums.txt"; \
grep " ${_tar}\$" /tmp/gitleaks_checksums.txt | (cd /tmp && sha256sum -c -); \
tar -xz -C /go/bin --no-same-owner -f "/tmp/${_tar}" gitleaks; \
rm -f "/tmp/${_tar}" /tmp/gitleaks_checksums.txt; \
/go/bin/gitleaks version

# Install golangci-lint v2
RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
Expand Down
Loading