fix: retrieval hydration and lexical search refinements for page memory #325

	name: Secret Scan

	on:
	pull_request:
	branches:
	- main
	- staging

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	gitleaks:
	name: Gitleaks
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- name: Checkout code
	uses: actions/checkout@v6
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Install gitleaks
	shell: bash
	run: \|
	set -euo pipefail
	version="8.30.1"
	archive="gitleaks_${version}_linux_x64.tar.gz"
	curl --fail --location --silent --show-error \
	--output "${archive}" \
	"https://github.com/gitleaks/gitleaks/releases/download/v${version}/${archive}"
	tar -xzf "${archive}" gitleaks
	install -m 0755 gitleaks /usr/local/bin/gitleaks
	gitleaks version

	- name: Scan current tree
	shell: bash
	run: \|
	set -euo pipefail
	mkdir -p secret-scan-results
	gitleaks dir . \
	--no-banner \
	--redact=100 \
	--report-format json \
	--report-path secret-scan-results/gitleaks-tree-findings.json \
	--exit-code 1

	- name: Scan git history
	shell: bash
	run: \|
	set -euo pipefail
	mkdir -p secret-scan-results
	gitleaks git . \
	--log-opts="--all --full-history -m" \
	--no-banner \
	--redact=100 \
	--report-format json \
	--report-path secret-scan-results/gitleaks-history-findings.json \
	--exit-code 1

	- name: Upload redacted scan report
	if: failure()
	uses: actions/upload-artifact@v4
	with:
	name: gitleaks-redacted-findings
	path: secret-scan-results/*.json
	if-no-files-found: ignore

Provide feedback