Simple script to scan an array of repositories for secrets

github-leaks.sh

#!/usr/bin/env bash

working_dir="$(pwd)"

## Exit if dependences are not installed
missing_deps=""
command -v gh > /dev/null || missing_deps+="gh "
command -v git > /dev/null || missing_deps+="git "
command -v ssh > /dev/null || missing_deps+="openssh "
command -v gitleaks > /dev/null || missing_deps+="gitleaks "

if [[ -n "${missing_deps[@]}" ]]
then
    echo "Please install the following dependencies: ${missing_deps[@]}"
    exit 1
fi

## Show usage if --help or -h are passed or if no arguments are passed
if [[ -z $@ ]] || echo $@ | grep -qE '\-h|\-\-help'
then
    echo "usage: $0 https://github.com/example/repo https://github.com/example/repo2"
else
    urls="$@"
fi

## Check if logged into Github CLI -- login if not
gh auth status 2>&1 >/dev/null  | grep -q 'Logged in' || gh auth login
if ! gh auth status 2>&1 >/dev/null  | grep -q 'Logged in'
then
    echo 'Error encounterd, please login to Github CLI with `gh auth login`'
    exit 2
fi


## Function to check if argument is repository
check_repo () {
    url="$1"
    ## Regex to check if github.com in url 
    echo ${url} | grep -Eqo "github\.com\/(.*)" \
	&& user=$(echo ${url} | grep -Eo "github\.com\/(.*)" | cut -d '/' -f 2) \
	&& repo=$(echo ${url} | grep -Eo "github\.com\/(.*)" | cut -d '/' -f 3) \
	&& git ls-remote ${url} && valid_url="true"
}

## Function to clone uri locally to scan
clone_repo () {
    url="$1"
    path="$2"
    [[ ${valid_url} == "true" ]] && git clone ${url} ${path}
}

scan_repo () {
    repo="$1"
    cd /tmp/${repo}
    gitleaks detect --report-path /tmp/$(date "+%Y-%d-%m_%H:%M_${repo}_gitleaks.json") --verbose
}

## If arguments were supplied, begin scanning! 
if [[ -n ${urls} ]]
then
    for url in ${urls}
    do
	user=""
	repo=""
	valid_url=""
	echo ${url} | grep -Eqo "github\.com\/(.*)" \
	    && check_repo ${url}
	[[ -n ${repo} ]] && [[ ${valid_url} == "true" ]] && clone_repo ${url} /tmp/${repo} \
	    && scan_repo ${repo} 
	rm -rf /tmp/${repo}
    done
fi

cd ${working_dir}