We are experiencing issues with Gitleaks pipeline which is failing with ERR Failed to locate unzip command '/usr/bin/unzip'! although this is running on Windows agent.
If we run this same pipeline on Linux agent it finish without errors and works fine.
This is example of run on Windows agent:
Starting: Gitleaks
Task : Gitleaks scan
Description : Scan git repos (or files) for secrets using regex and entropy.
Version : 2.2.30
Author : Joost Voskuil ([email protected])
Help : More information
Thanks to Zachary Rice (https://github.com/zricethezav) for creating and maintaining gitleaks.
Thanks to Jesse Houwing (https://github.com/jessehouwing) for providing a gitleaks config that has most of Microsoft's deprecated credscan rules ported to it.
The latest version of the tool is available in the toolcache. Version is 8.9.0
Found tool in cache: gitleaks 8.9.0 x64
C:\hostedtoolcache\windows\gitleaks\8.9.0\x64\gitleaks.exe detect --config=./GitLeaks/GitLeaks.toml --source=F:\build\autobv.9\35\s --redact --report-format=sarif --report-path=F:\build\autobv.9_temp\gitleaks-report-12f1170f-54f2-53f3-20dd-22fc7dff55f9.sarif
8:26AM ERR Failed to locate unzip command '/usr/bin/unzip'!
8:26AM ERR Failed to locate unzip command '/usr/bin/unzip'!
8:26AM ERR Failed to locate unzip command '/usr/bin/unzip'!
8:28AM ERR Failed to locate unzip command '/usr/bin/unzip'!
##[error]See https://docs.github.com/en/github/authenticating-to-github/removing-sensitive-data-from-a-repository for information how to remove secrets.
##[warning]Secrets found or error encountered when running Gitleaks. See log and report for details.
Finishing: Gitleaks
And this is how our task is configured:
- task: Gitleaks@2
inputs:
scanlocation: '$(Build.SourcesDirectory)'
configtype: 'custom'
configfile: ./GitLeaks/GitLeaks.toml
uploadresults: true
reportformat: 'sarif'
scanmode: all
taskfail: false
Strange thing is that this error appears only when scanmode is set to all, if it's set to prevalidation and run for PR it goes through without errors on Windows agents.
Starting: Gitleaks
Task : Gitleaks scan
Description : Scan git repos (or files) for secrets using regex and entropy.
Version : 2.2.30
Author : Joost Voskuil ([email protected])
Help : More information
Thanks to Zachary Rice (https://github.com/zricethezav) for creating and maintaining gitleaks.
Thanks to Jesse Houwing (https://github.com/jessehouwing) for providing a gitleaks config that has most of Microsoft's deprecated credscan rules ported to it.
Only commits belonging to this Pull Request are scanned.
Scanning for 29 Git commit(s) for this build. First commit is 62322a1ee0b829, Last commit is fc75d133b48
The latest version of the tool is available in the toolcache. Version is 8.9.0
Found tool in cache: gitleaks 8.9.0 x64
C:\hostedtoolcache\windows\gitleaks\8.9.0\x64\gitleaks.exe detect --config=./GitLeaks/GitLeaks.toml --source=F:\build\autobv.3\221\s/src/Services/Functions/Reporting/ReportingFunction "--log-opts=62322a1ee0b829^! fc75d133b48" --redact --report-format=sarif --report-path=F:\build\autobv.3_temp\gitleaks-report-041a692d-d80f-5a06-0b64-9e4539023300.sarif
8:04AM INF scan completed in 190.5997ms
8:04AM INF no leaks found
Finishing: Gitleaks