deps(dev): bump the python-dev-minor group with 15 updates #33

	name: Secret Scanning

	on:
	push:
	branches: [main, master]
	pull_request:
	branches: [main, master]

	# Cancel in-progress runs for the same branch/PR to reduce CI load
	# New pushes to the same branch will cancel older in-progress runs
	concurrency:
	group: secret-scanning-${{ github.ref }}
	cancel-in-progress: true

	# Least-privilege permissions: read-only by default
	# Gitleaks only needs to read repository contents
	# Fork PRs run with read-only permissions automatically
	permissions:
	contents: read
	pull-requests: read

	jobs:
	gitleaks:
	runs-on: ubuntu-latest
	# Fork PR hardening: detect fork context
	env:
	IS_FORK_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	fetch-depth: 0 # Full history for comprehensive scanning

	- name: Run Gitleaks
	uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Disable summary for fork PRs (may require write permissions)
	GITLEAKS_ENABLE_SUMMARY: ${{ env.IS_FORK_PR == 'true' && 'false' \|\| 'true' }}

Provide feedback