secret-scanner.yml

# SPDX-License-Identifier: MPL-2.0
name: Secret Scanner

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  # secret-scanner-reusable.yml's `gitleaks` job declares JOB-level
  # `pull-requests: write` + `actions: read` (its own comment: "Reusable-
  # workflow permission blocks OVERRIDE the caller's, so this MUST live here
  # at source"). A caller granting less than the reusable declares is refused
  # before any job starts — the observed failure was `startup_failure` with
  # zero jobs and no log, which is the signature of caller-under-grant, NOT a
  # scan result. gitleaks never ran at all.
  pull-requests: write
  actions: read

jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
    secrets: inherit