ci(deps): bump actions/setup-node from 6 to 7 #409

	name: Secret Scan

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]

	# Minimal permissions: secretlint only needs to read repository contents.
	# The workflow does not comment on PRs, upload artifacts, or modify state.
	permissions:
	contents: read

	jobs:
	secretlint:
	name: secretlint
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7
	with:
	# Full history lets secretlint see any new files introduced in a PR
	fetch-depth: 0

	- name: Setup Node.js
	uses: actions/setup-node@v7
	with:
	node-version: '20'
	cache: 'npm'

	- name: Install dependencies
	# See test.yml for the --legacy-peer-deps rationale (mappersmith / diff conflict).
	run: npm ci --ignore-scripts --legacy-peer-deps

	- name: Run secretlint
	# Scan everything except what .secretlintignore excludes. The pre-commit
	# hook only scans staged files (fast); this CI job is the authoritative
	# check that catches anything that slipped through --no-verify.
	run: npx secretlint --maskSecrets "*/" "*/."

Provide feedback