secret-scan.yml

name: Secret Scan

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Full history so gitleaks can diff the entire PR range
          fetch-depth: 0

      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc0b8f7f7d6bd2f0d9ce5df916 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml
          # GITLEAKS_LICENSE is only required for private repos on the paid plan.
          # For public repos or the free OSS plan, omit it.
          # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}