security: re-pin secret scanner onto the real gitleaks gate (#53) #260

	# SPDX-License-Identifier: MPL-2.0
	permissions:
	contents: read

	name: Container Policy
	on:
	push:
	branches: [main, master]
	pull_request:

	# Estate guardrail: scope push to default branches so a PR fires once (not
	# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	jobs:
	check:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- name: Enforce container policy
	run: \|
	# Block new Dockerfiles
	NEW_DOCKER=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null \| grep -iE 'dockerfile' \|\| true)
	if [ -n "$NEW_DOCKER" ]; then
	echo "❌ New Dockerfile detected. Use Containerfile instead."
	exit 1
	fi

	# Check for docker command usage in scripts
	DOCKER_CMD=$(grep -r "docker build\\|docker run\\|docker push" --include=".sh" --include=".yml" --include="*.yaml" . 2>/dev/null \| grep -v "nerdctl\\|podman" \| head -5 \|\| true)
	if [ -n "$DOCKER_CMD" ]; then
	echo "⚠️ docker command found. Prefer nerdctl or podman:"
	echo "$DOCKER_CMD"
	fi

	echo "✅ Container policy check passed"

Provide feedback