chore(deps): Bump js-yaml from 4.3.1 to 4.3.2 #60

	name: Secret scan

	# Runs on pull requests so a leak is caught before it reaches main. Once a secret
	# is on a shared branch it must be treated as compromised and rotated — removing the
	# commit afterwards does not undo that. Blocking the merge is the only real fix.
	#
	# The scheduled full-history run is a second line of defence: rules improve over
	# time, so a pattern that was not recognised when a commit landed may be later.
	on:
	pull_request:
	schedule:
	- cron: '0 5 * * 1'
	workflow_dispatch:

	permissions:
	contents: read
	# gitleaks lists the pull request's commits to scan only what the PR adds; without
	# this the API call 403s and the job fails before scanning anything.
	pull-requests: read

	jobs:
	gitleaks:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v7
	with:
	# Full history: on a PR gitleaks diffs the branch, but the scheduled run
	# needs every commit ever made.
	fetch-depth: 0

	- uses: gitleaks/gitleaks-action@v3
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Findings belong in the job log and the failed check, not in PR comments:
	# writing a comment needs pull-requests: write, and a Dependabot PR gets a
	# read-only token, so leaving this on makes those runs fail spuriously.
	GITLEAKS_ENABLE_COMMENTS: false
	# Do not phone home with usage data.
	GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
	# GITLEAKS_LICENSE is only required for organisation accounts; personal
	# repositories run without it.

Navigation Menu