Merge pull request #1125 from d-morrison/jules-1260477943241842034-35… #11

	# Thin caller of Morrison-Lab/gha's reusable gitleaks history scan.
	#
	# History rather than the diff: a secret committed and later removed is still
	# exposed, because the orphaned commit stays fetchable through the GitHub API
	# until the repository is garbage-collected. This repo is public, so that
	# window is open to anyone.
	#
	# Baseline measured 2026-08-24 with gitleaks from Homebrew: 2824 commits,
	# ~756 MB scanned, no leaks found -- so this can run with the default
	# `fail: true` without a suppression backlog.
	#
	# Deliberately NOT on `pull_request`, unlike the upstream example. That
	# baseline scan took 10m8s, and a PR's commits only enter the history this
	# checks when the PR merges -- so a per-push run would re-scan 2824 unchanged
	# commits to evaluate a handful of new ones. The push-to-main run covers the
	# merge, and the weekly schedule covers anything that reaches the repo another
	# way.
	name: Check for secrets

	on:
	push:
	branches:
	- main
	schedule:
	# Mondays, 08:00 UTC.
	- cron: '0 8 * * 1'
	workflow_dispatch:

	jobs:
	check:
	# The repo default is write, so declare the read-only scope this
	# reusable workflow's own job asks for rather than inheriting it.
	permissions:
	contents: read
	uses: Morrison-Lab/gha/.github/workflows/check-secrets.yml@v2

Navigation Menu