From 80c7f3ec5c1cd684a6a9f9f6399d492472e06537 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 15 Aug 2026 05:42:56 +0000
Subject: [PATCH 1/2] Add Gitleaks scan job to CI using GITLEAKS_KEY license

Co-authored-by: VrilLabs <271641621+VrilLabs@users.noreply.github.com>
---
 .github/workflows/ci.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2a5c55..a3561da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,6 +56,25 @@ jobs:
           path: ./
           extra_args: --debug --only-verified
 
+  gitleaks:
+    name: Gitleaks Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_KEY }}
+
   static-analysis:
     name: Static Analysis
     runs-on: ubuntu-latest

From 071cc0762ba1e6a9243e918904b0a4c74ba9106f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Aug 2026 06:32:17 +0000
Subject: [PATCH 2/2] plan: skip gitleaks on forked PRs

Co-authored-by: VrilLabs <271641621+VrilLabs@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a3561da..a1da350 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,6 +58,8 @@ jobs:
 
   gitleaks:
     name: Gitleaks Scan
+    # Secrets (GITLEAKS_KEY) are unavailable on workflows from forked PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       contents: read