Skip to content

Add gitleaks secret scan #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
george-elphick-talieisin merged 1 commit into from
Apr 23, 2026
Merged

Add gitleaks secret scan #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/secret-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
name: Secret scan
on:
pull_request:
push:
branches: [main, master]
Comment on lines +4 to +5
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description says this runs on push to the default branch, but the workflow is hard-coded to only run on pushes to main or master. If this repo’s default branch is different (or gets renamed), pushes won’t be scanned. Update on.push.branches to match the actual default branch for this repo (and avoid listing branches you don’t intend to support).

Copilot uses AI. Check for mistakes.

jobs:
scan:
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider setting explicit minimal permissions for this workflow (or job) so the GITHUB_TOKEN doesn’t inherit broader-than-needed defaults from org/repo settings. Secret scanning typically only needs contents: read (and possibly pull-requests: read depending on the reusable workflow).

Suggested change
scan:
scan:
permissions:
contents: read
pull-requests: read

Copilot uses AI. Check for mistakes.
uses: Talieisin/.github/.github/workflows/secret-scan.yml@main
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reusable workflow is referenced with @main, which can change over time and introduces a supply-chain risk (a compromised or buggy update would affect this repo immediately). Pin the uses: ref to a tagged release or a specific commit SHA and update it intentionally when you want new behavior.

Suggested change
uses: Talieisin/.github/.github/workflows/secret-scan.yml@main
uses: Talieisin/.github/.github/workflows/secret-scan.yml@0123456789abcdef0123456789abcdef01234567

Copilot uses AI. Check for mistakes.
Loading