security.yaml

name: Security

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [develop, main]

permissions:
  contents: read

jobs:
  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          # A secret is not undone by a later commit: it stays in history and
          # has to be rotated. Scanning the tip only would miss it.
          fetch-depth: 0

      - name: Install gitleaks
        run: |
          GITLEAKS_VERSION=8.30.1
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks

      - name: Run gitleaks
        run: gitleaks detect --no-banner --redact