secrets.yml

name: Secret scanning
on: [push, pull_request]
permissions:
  contents: read
jobs:
  secrets:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Download pinned scanner and verify checksum
        working-directory: ${{ runner.temp }}
        run: |
          curl --fail --location --proto '=https' --tlsv1.2 --output gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
          echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz' | sha256sum --check
          tar -xzf gitleaks.tar.gz gitleaks
      - name: Scan history and checkout (redacted; no reports uploaded)
        run: |
          "$RUNNER_TEMP/gitleaks" git . --log-opts=--all --redact --no-banner
          "$RUNNER_TEMP/gitleaks" dir . --redact --no-banner