chore(deps): bump docker/setup-buildx-action from 3 to 4 (#121) #311
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Gitleaks | |
| # Scans the working tree for secret patterns (API keys, tokens, private | |
| # keys, connection strings) on every push and PR. Audit EW-16 | |
| # (2026-06-11). The local pre-commit hook half of EW-16 is deferred | |
| # until husky is adopted; the Action half catches anything that reaches | |
| # the remote. | |
| # | |
| # Runs the official gitleaks Docker image directly rather than the | |
| # gitleaks/gitleaks-action wrapper. The action wrapper requires | |
| # GITLEAKS_LICENSE for any org-owned repo (gitleaks.io is the licensor), | |
| # but gitleaks itself is MIT-licensed and runs unrestricted in the | |
| # Docker image. Inline `gitleaks:allow` comments suppress known | |
| # false positives at the code site. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Superseded runs are cancelled. Pushing three times to a PR used to run three | |
| # full suites to completion; only the newest tells you anything. | |
| concurrency: | |
| group: gitleaks-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Shallow on purpose: the scan below is --no-git, so the full history | |
| # was being downloaded and never read. | |
| - uses: actions/checkout@v7 | |
| - name: Run gitleaks (Docker) | |
| run: | | |
| # --no-git scans the working tree only, not git history. | |
| # Historical commits may contain pre-suppression versions of | |
| # known-safe constants (e.g. the share-password alphabet), | |
| # which are still fine — what we want to block is NEW secrets | |
| # in the proposed code. The push event sees what landed; the | |
| # PR event sees what's about to land. Either way, working-tree | |
| # scan is sufficient. | |
| docker run --rm \ | |
| -v "${{ github.workspace }}:/path" \ | |
| zricethezav/gitleaks:v8.30.1 \ | |
| detect \ | |
| --source=/path \ | |
| --no-git \ | |
| --redact \ | |
| --verbose \ | |
| --exit-code=1 |