name: Gitleaks Secret Scan
on:
push:
branches: [ main, coreason-develop ]
pull_request:
branches: [ main, coreason-develop ]
workflow_dispatch:
permissions:
contents: read
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
jobs:
gitleaks:
name: Gitleaks Secret Scanner
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Harden Runner (Endpoint Network Security)
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd with:
fetch-depth: 0
- name: Gitleaks Scan
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}