secret-scan.yml

name: Secret scan

# Runs on pull requests so a leak is caught *before* it reaches main. Once a secret
# is on a shared branch it must be treated as compromised and rotated — removing the
# commit afterwards does not undo that. Blocking the merge is the only real fix.
#
# The scheduled full-history run is a second line of defence: rules improve over
# time, so a pattern that was not recognised when a commit landed may be later.
on:
  pull_request:
  schedule:
    - cron: '0 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  # gitleaks lists the pull request's commits to scan only what the PR adds; without
  # this the API call 403s and the job fails before scanning anything.
  pull-requests: read

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # Full history: on a PR gitleaks diffs the branch, but the scheduled run
          # needs every commit ever made.
          fetch-depth: 0

      - uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Findings belong in the job log and the failed check, not in PR comments:
          # writing a comment needs pull-requests: write, and a Dependabot PR gets a
          # read-only token, so leaving this on makes those runs fail spuriously.
          GITLEAKS_ENABLE_COMMENTS: false
          # Do not phone home with usage data.
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
          # GITLEAKS_LICENSE is only required for organisation accounts; personal
          # repositories run without it.