style(scripts): ruff format generate_coloring_instances.py #4

	name: Secret scan

	# Defence-in-depth secret scanning. pre-commit runs gitleaks locally, this
	# workflow re-runs it on the server so a PR from a contributor who skipped
	# pre-commit (or disabled the hook) is still caught before merge.

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	# Weekly full-history scan, catches secrets accidentally committed on
	# an out-of-band branch that never hit a PR.
	- cron: "0 6 * * 1"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	gitleaks:
	name: gitleaks
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	# Full history so we scan the entire commit graph, not just the
	# pushed-diff.
	fetch-depth: 0

	- uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Navigation Menu