secret-scan.yml

name: Secret scan

# Source-of-truth secret detection. Runs on every PR and on pushes to main.
# The local pre-commit hook (bin/install-git-hooks) is fast feedback; this
# workflow is the gate that secrets cannot bypass via `git commit --no-verify`.

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  gitleaks:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          # gitleaks needs full history to scan the diff range. fetch-depth: 0
          # is the documented setup for the official action.
          fetch-depth: 0

      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Use the .gitleaks.toml at the repo root.
          GITLEAKS_CONFIG: .gitleaks.toml