check-secrets.yml

# Thin caller of Morrison-Lab/gha's reusable gitleaks history scan.
#
# History rather than the diff: a secret committed and later removed is still
# exposed, because the orphaned commit stays fetchable through the GitHub API
# until the repository is garbage-collected. This repo is public, so that
# window is open to anyone.
#
# Baseline measured 2026-08-24 with gitleaks from Homebrew: 2824 commits,
# ~756 MB scanned, **no leaks found** -- so this can run with the default
# `fail: true` without a suppression backlog.
#
# Deliberately NOT on `pull_request`, unlike the upstream example. That
# baseline scan took 10m8s, and a PR's commits only enter the history this
# checks when the PR merges -- so a per-push run would re-scan 2824 unchanged
# commits to evaluate a handful of new ones. The push-to-main run covers the
# merge, and the weekly schedule covers anything that reaches the repo another
# way.
name: Check for secrets

on:
  push:
    branches:
      - main
  schedule:
    # Mondays, 08:00 UTC.
    - cron: '0 8 * * 1'
  workflow_dispatch:

jobs:
  check:
    # The repo default is write, so declare the read-only scope this
    # reusable workflow's own job asks for rather than inheriting it.
    permissions:
      contents: read
    uses: Morrison-Lab/gha/.github/workflows/check-secrets.yml@v2