secret-scan.yml

name: Secret scan

# Runs on pull requests so a leak is caught *before* it reaches main. Once a secret
# is on a shared branch it must be treated as compromised and rotated — removing the
# commit afterwards does not undo that. Blocking the merge is the only real fix.
#
# The scheduled full-history run is a second line of defence: rules improve over
# time, so a pattern that was not recognised when a commit landed may be later.
on:
  pull_request:
  schedule:
    - cron: '0 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # Full history: on a PR gitleaks diffs the branch, but the scheduled run
          # needs every commit ever made.
          fetch-depth: 0

      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # GITLEAKS_LICENSE is only required for organisation accounts; personal
          # repositories run without it.