docs(adr): ADR-022 — persona colleagues, separating who an agent is f… #2099

	name: Secret Scan

	on:
	push:
	branches: [ main, v1.0.x ]
	pull_request:
	branches: [ main, v1.0.x ]

	permissions:
	contents: read

	# Push fallback is github.sha, not github.ref — see the long note in tests.yml.
	# This workflow is push-triggered too, so it had the same collapse: 9 of 40
	# runs on main cancelled by the next merge. A secret scan that gets cancelled
	# is the one result you least want to read as "fine".
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.sha }}
	cancel-in-progress: true

	jobs:
	gitleaks:
	name: Detect secrets
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Install gitleaks
	run: \|
	curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
	\| tar -xz gitleaks
	sudo mv gitleaks /usr/local/bin/gitleaks

	- name: Run gitleaks (all our branch commits, excluding submodule history)
	run: \|
	# Scan the full history of our branches (not --all, which includes
	# submodule git objects from _external/clawdbot).
	# ~500 commits, ~15s. Catches historical leaks in our own code.
	gitleaks detect --source . --config .gitleaks.toml --redact -v \
	--log-opts="--branches --remotes=origin/main --remotes=origin/v1.0.x"

Navigation Menu