secrets.yml

name: Secrets
on:
  pull_request: ~
  push:
    branches:
      - main
      - main-v1
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch: ~

permissions: read-all

jobs:
  secrets:
    name: Secrets
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            objects.githubusercontent.com:443
      - name: Checkout repository
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          fetch-depth: 0
      - name: Scan for secrets
        uses: gitleaks/gitleaks-action@1f2d10fb689bc07a5f56f48d6db61f5bbbe772fa # v2.3.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_COMMENTS: false
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
          GITLEAKS_ENABLE_SUMMARY: true