fix(fal): classify 403 balance-exhausted as insufficient_balance, not… #395

	name: Secret Scan

	# Authoritative, always-on gate for credentials/secrets in the working tree.
	# Runs on every PR and every push to main, regardless of which paths changed.
	#
	# Uses the open-source gitleaks CLI directly (MIT, free) rather than
	# gitleaks-action, which requires a paid license for organization-owned repos.
	#
	# We scan the current working tree (`gitleaks dir`), NOT git history: a PR gate
	# should fail on what the PR introduces, and scanning full history would block
	# every PR forever if any secret was ever committed in the past. History is a
	# separate remediation concern (rotate + optional rewrite).
	#
	# NOTE: gitleaks detects high-entropy / structured secrets (API keys, tokens,
	# private keys). It does NOT catch arbitrary internal product names or private
	# hostnames — those are covered by the CONTRIBUTING.md policy and human review.
	# For the strongest coverage, also enable GitHub "Secret scanning" + "Push
	# protection" in repo Settings → Code security (free for public repos).

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	gitleaks:
	name: gitleaks
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Scan working tree for secrets
	run: \|
	# Drop .git so only working-tree files are scanned (no history), then
	# run the official gitleaks image. Non-zero exit = leak found = fail.
	rm -rf .git
	docker run --rm -v "${{ github.workspace }}:/repo" \
	ghcr.io/gitleaks/gitleaks:latest \
	dir /repo --config /repo/.gitleaks.toml --redact --verbose --exit-code 1

Navigation Menu