## Announcements
### 📢 Release of Gitleaks-Action v2
_6/13/2022_
On June 2, 2022, we released [Gitleaks Action v2](https://github.com/gitleaks/gitleaks-action/releases/tag/v2.0.0). There are a boatload of improvements
in v2, but it also represents a breaking change from the prior version (v1.6.0). We haven't merged v2 to the `master` branch yet because we noticed that
many users of Gitleaks Action don't pin their version. If you are using `zricethezav/gitleaks-action@master` (or now `gitleaks/gitleaks-action@master`),
then as soon as we merge v2 to master, your jobs will start fa
iling.
#### How to upgrade to v2
For full details, see the rest of the v2 [README](readme.md#usage-example). Here is the quick list of changes to your .yml:
* Change the "uses" line to `- uses: gitleaks/gitleaks-action@v2`
* Add an `env:` section with `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}`
* If you are scanning repos that belong to an organization, you'll also have to [acquire a GITLEAKS_LICENSE](https://gitleaks.io/products.html),
add the license to your GitHub Secrets, and add this line to the `env:` section: `GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}`
#### How to pin to v1.6.0
* Change your "uses" line to `gitleaks/gitleaks-action@v1.6.0`
* Set a reminder to upgrade to v2 later.
## v2 Benefits
If you are using Gitleaks-Action v2 to scan repos owned by an [Organization](https://docs.github.com/en/get-started/learning-about-github/types-of-github-accounts#organization-accounts),
you will find that you need to [acquire a GITEAKS_LICENSE](https://gitleaks.io/products.html) in order for the action to run. A ["Starter" license](https://gitleaks.io/products.html#:~:text=in%20your%20inbox.-,Starter,-Free%20for%201) to scan 1 repo is
free, but scanning more than 1 repo belonging to the same organization requires a paid license. This raises the obvious question:
**_Is v2 really worth paying for?_**
It's a fair question. We think that the new features and improvements in v2 deliver exceptional value for the price. We put together a list of some of the
top reasons we think v2 is worth paying for.
#### 1. On demand scans
You can now use `workflow_dispatch` events to trigger on demand gitleaks scans.
#### 2. Gitleaks report artifact uploads
Not much more to say here. Download reports when leaks are present. Pretty useful feature.
#### 3. Powered by the latest version of Gitleaks
The latest version of gitleaks (v8.8.6 at the time of writing) has better performance, more configuration options, and is more accurate than the previous major version.
#### 4. Job summaries
Easy to understand report of a Gitleaks job. If no leaks are detected you'll see:
If leaks are detected you'll see something like:
#### 5. Faster job times
Gitleaks-Action Version 2 does not rely on Docker build anymore.
#### 6. Pull Request Comments
If a leak is encountered during a pull request, gitleaks-action will comment on the line number and commit containing the secret.
#### 7. Ensure Project Longevity
Gitleaks is used by thousands (millions?) of developers around the world. It is used by individuals, governments, and corporations to prevent and detect
leaked secrets. Until now, everything associated with gitleaks has been Free and Open Source under the MIT License, maintained primarily as a side project
by 1 person. Let's be honest, that wasn't a sustainable model (and it was starting to feel like an [xkcd comic](https://xkcd.com/2347/)).
By buying a `GITLEAKS_LICENSE` to use v2, you are supporting the gitleaks project as a whole and helping to ensure the longevity of the project.