Fix Gitleaks PR scan workflow after action token requirement change

[Copilot]

The Gitleaks secret scan GitHub Actions job was failing before any scan ran because gitleaks/gitleaks-action@v2 now requires GITHUB_TOKEN on pull_request events. The workflow also passed an unsupported args input that was ignored at runtime.

• Workflow fix

  • pass GITHUB_TOKEN to the gitleaks step via env
  • add job-local read permissions required for PR metadata access
  • disable PR comment publishing to keep the job read-only

• Cleanup

  • remove the unused with.args entry that the action does not accept

• Result

  • restores PR secret scanning without broadening repository permissions
  • removes the runtime warning from the gitleaks step

gitleaks-scan:
  permissions:
    contents: read
    pull-requests: read
  steps:
    - uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GITLEAKS_ENABLE_COMMENTS: false

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[Copilot]

Pull request overview

This PR adjusts the CI workflow’s Gitleaks secret scan job configuration to address a failing GitHub Actions run by changing how the gitleaks/gitleaks-action@v2 step is invoked and reducing GitHub token permissions/commenting behavior.

Changes:

• Adds an explicit, restricted permissions: block for the gitleaks-scan job.
• Sets GITLEAKS_ENABLE_COMMENTS: false and provides GITHUB_TOKEN to the Gitleaks action via env.
• Removes the previously configured explicit Gitleaks CLI args (including --redact and --verbose).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e64dfacee0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Upgrade the Gitleaks action runtime

On GitHub-hosted ubuntu-latest runs after June 2, 2026, this step still invokes gitleaks-action@v2; the upstream action README says v2 uses Node 20 and will fail unless ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set, and this workflow does not set that opt-out. As a result, the Gitleaks job can remain broken before it reaches the token/comment changes; upgrade to gitleaks-action@v3 instead of keeping v2 here.

Useful? React with 👍 / 👎.