name: scan
on:
pull_request:
push:
branches: [main]
schedule:
- cron: '0 6 * * 1'
permissions:
contents: read
pull-requests: read
jobs:
gitleaks:
name: gitleaks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 with:
config-path: .gitleaks.toml
ripsecrets:
name: ripsecrets
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - run: cargo install ripsecrets --locked
- run: ripsecrets --strict-ignore .
cargo-deny:
name: cargo-deny advisories
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 with:
command: check advisories
manifest-path: cargo-deny.toml