secrets.yml

name: Secrets
on:
  pull_request: ~
  push:
    branches:
      - main
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch: ~

permissions: read-all

jobs:
  secrets:
    name: Secrets
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            objects.githubusercontent.com:443
      - name: Checkout repository
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          fetch-depth: 0
      - name: Scan for secrets
        uses: gitleaks/gitleaks-action@cb7149a9b57195b609c63e8518d2c6056677d2d0 # v2.3.3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_COMMENTS: false
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
          GITLEAKS_ENABLE_SUMMARY: true