gitleaks.yml

name: Secret Detection (gitleaks)

on:
  push:
    branches:
      - master
      - main
  pull_request:
    branches:
      - master
      - main
  workflow_dispatch:

jobs:
  gitleaks:
    name: Detect Secrets
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml
          GITLEAKS_ENABLE_COMMENTS: true
          GITLEAKS_ENABLE_SUMMARY: true