Sync local commits to main #215
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| name: Secret Scanner | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| # Explicit job-level permissions matching what the pinned reusable's | |
| # gitleaks job declares (pull-requests: write for the PR summary | |
| # comment, actions: read for its workflow-run metadata calls). | |
| # Without this grant the reusable's job-level request exceeds the | |
| # caller's workflow-level contents:read cap and the run dies at | |
| # startup ("permissions can only be reduced, not elevated"). | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| actions: read | |
| uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80 | |
| secrets: inherit |