From f2f0d909d10a7d4319c8ff25aa1da55eb3c4715e Mon Sep 17 00:00:00 2001
From: adoosh-afk <ammar@reclaimed.health>
Date: Tue, 28 Jul 2026 04:41:08 +0100
Subject: [PATCH] fix(ci): support macOS gitleaks runners

---
 .github/workflows/shared-secrets-scan.yml | 14 ++++++++++----
 README.md                                 |  2 +-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/shared-secrets-scan.yml b/.github/workflows/shared-secrets-scan.yml
index b02a571..7f080d1 100644
--- a/.github/workflows/shared-secrets-scan.yml
+++ b/.github/workflows/shared-secrets-scan.yml
@@ -27,8 +27,9 @@ name: Shared secrets scan
 # sibling adoption PR can succeed.
 #
 # Behaviour:
-#   - arch-detect (arm64|x64); UNSUPPORTED ARCH => error + exit 1 (fail-closed).
-#   - download the pinned gitleaks release for the detected arch.
+#   - platform/arch-detect (linux|darwin × arm64|x64); unsupported pairs error
+#     and exit 1 (fail-closed).
+#   - download the pinned gitleaks release for the detected platform and arch.
 #   - `gitleaks detect` over the requested source-path + log-opts.
 # This workflow is NEVER gated on docs-only: a markdown PR pasting a real
 # credential is exactly the threat model it exists for (Modelsmith #1041).
@@ -83,12 +84,17 @@ jobs:
           clean: true
           fetch-depth: 0
 
-      - name: Install gitleaks (arch-aware, pinned)
+      - name: Install gitleaks (platform- and arch-aware, pinned)
         env:
           GITLEAKS_VERSION: ${{ inputs.gitleaks-version }}
         run: |
           set -euo pipefail
           echo "Installing gitleaks v${GITLEAKS_VERSION}"
+          case "$(uname -s)" in
+            Linux)  GITLEAKS_OS=linux ;;
+            Darwin) GITLEAKS_OS=darwin ;;
+            *) echo "::error::Unsupported OS $(uname -s) for gitleaks install"; exit 1 ;;
+          esac
           case "$(uname -m)" in
             aarch64|arm64) GITLEAKS_ARCH=arm64 ;;
             x86_64)        GITLEAKS_ARCH=x64 ;;
@@ -96,7 +102,7 @@ jobs:
           esac
           GITLEAKS_BIN_DIR="${RUNNER_TEMP}/gitleaks-bin"
           mkdir -p "$GITLEAKS_BIN_DIR"
-          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${GITLEAKS_ARCH}.tar.gz" \
+          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${GITLEAKS_OS}_${GITLEAKS_ARCH}.tar.gz" \
             | tar -xz -C "$GITLEAKS_BIN_DIR" gitleaks
           echo "$GITLEAKS_BIN_DIR" >> "$GITHUB_PATH"
 
diff --git a/README.md b/README.md
index b93abad..042b35f 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ It is deliberately **public** so that public org repos (e.g. [`assay-harness`](h
 
 ### `shared-secrets-scan.yml` — gitleaks secrets scan
 
-Arch-aware, version-pinned `gitleaks detect`. The single source of truth for the org secrets-scan gate; runs with `permissions: contents: read` only (no secrets, fork-PR safe).
+Platform- and arch-aware, version-pinned `gitleaks detect` (Linux or macOS on arm64 or x64). The single source of truth for the org secrets-scan gate; runs with `permissions: contents: read` only (no secrets, fork-PR safe).
 
 Consume it with a **40-char commit SHA pin** (never a branch or mutable tag):