ci(deps): bump github/codeql-action from 3 to 4 #4

	name: Secret scan

	# Runs on pull requests so a leak is caught before it reaches main. Once a secret
	# is on a shared branch it must be treated as compromised and rotated — removing the
	# commit afterwards does not undo that. Blocking the merge is the only real fix.
	#
	# The scheduled full-history run is a second line of defence: rules improve over
	# time, so a pattern that was not recognised when a commit landed may be later.
	on:
	pull_request:
	schedule:
	- cron: '0 5 * * 1'
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	gitleaks:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	# Full history: on a PR gitleaks diffs the branch, but the scheduled run
	# needs every commit ever made.
	fetch-depth: 0

	- uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# GITLEAKS_LICENSE is only required for organisation accounts; personal
	# repositories run without it.

Navigation Menu