Align requests version across lockfiles #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scanning | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| # Cancel in-progress runs for the same branch/PR to reduce CI load | |
| # New pushes to the same branch will cancel older in-progress runs | |
| concurrency: | |
| group: secret-scanning-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Least-privilege permissions: read-only by default | |
| # Gitleaks only needs to read repository contents | |
| # Fork PRs run with read-only permissions automatically | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| # Fork PR hardening: detect fork context | |
| env: | |
| IS_FORK_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 # Full history for comprehensive scanning | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Disable summary for fork PRs (may require write permissions) | |
| GITLEAKS_ENABLE_SUMMARY: ${{ env.IS_FORK_PR == 'true' && 'false' || 'true' }} |