security: re-pin secret scanner onto the real gitleaks gate (#37) #125

	# SPDX-License-Identifier: MPL-2.0
	name: NPM/Bun Blocker
	on:
	push:
	branches: [main, master]
	pull_request:

	# Estate guardrail: scope push to default branches (PR fires once, not
	# push+PR) and cancel superseded runs. Safe — read-only PR check.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	check:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	- name: Block npm/bun
	run: \|
	if [ -f "package-lock.json" ] \|\| [ -f "bun.lockb" ] \|\| [ -f ".npmrc" ]; then
	echo "❌ npm/bun artifacts detected. Use Deno instead."
	exit 1
	fi
	echo "✅ No npm/bun violations"

Provide feedback