.github/workflows/secret-scan.yml #73

	name: secret-scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "17 6 * * 2"
	workflow_dispatch:

	permissions: {}

	concurrency:
	group: secret-scan-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	gitleaks:
	name: Gitleaks secret scan
	runs-on: ubuntu-latest
	timeout-minutes: 10
	permissions:
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0

	- name: Run gitleaks detect
	shell: bash
	run: \|
	set -euo pipefail
	image="zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f"
	docker run --rm \
	-v "${{ github.workspace }}:/repo" \
	"$image" \
	detect \
	--source /repo \
	--redact \
	--no-banner \
	--exit-code 1

Provide feedback