secret-scanner.yml

# SPDX-License-Identifier: MPL-2.0
name: Secret Scanner

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read

jobs:
  scan:
    # The reusable's gitleaks job no longer requests elevated permissions
    permissions:
      contents: read
    # Local relative path, not an external SHA pin — this is the repo that
    # *owns* the reusable, so it must scan itself with the current version
    # (same pattern as governance.yml). The previous pin
    # @891b1ed6164478616cb3375f328c6487ccb13f80 (2026-07-06) predated #500 and
    # still requested `pull-requests: write` + `actions: read`; a called
    # workflow cannot exceed its caller's grant, and this caller grants only
    # `contents: read`, so every run died at startup_failure — standards' own
    # secret scanning had not executed since that pin landed. A local path
    # cannot re-stale, so this class of breakage cannot recur here.
    uses: ./.github/workflows/secret-scanner-reusable.yml
    secrets: inherit