build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 in the actions group across 1 directory #164
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secrets scan | |
| # Three triggers covering the realistic leak surfaces: | |
| # - pull_request: catch a leak before it reaches main. | |
| # - push to main: catch a direct push that bypassed PR review. | |
| # - schedule (weekly): catch leaks already in history (a key rotated | |
| # today re-leaks if it remains in a historical commit) and catch | |
| # drift between gitleaks rule updates and our codebase. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Sunday 06:00 UTC — low-traffic window; weekly cadence balances | |
| # signal value against runner cost. | |
| - cron: "0 6 * * 0" | |
| permissions: | |
| # Read-only — secrets-scan must not be able to publish, comment, or | |
| # mint OIDC tokens. A compromised scanner that could write would be | |
| # worse than no scanner. | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| # Full history needed so the scheduled run inspects the | |
| # entire branch, not just the tip. | |
| fetch-depth: 0 | |
| - name: gitleaks | |
| uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| # gitleaks-action uses GITHUB_TOKEN to comment on PRs; the | |
| # default workflow token's read-only scope above is what we | |
| # want — the action falls back to log output when it can't | |
| # post comments. No GITLEAKS_LICENSE configured (we use the | |
| # OSS rule set, not the commercial Enterprise edition). | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Fail the workflow on any finding. Default in gitleaks-action | |
| # is to fail; this is explicit so a future config change | |
| # cannot silently relax the gate. | |
| GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "true" | |
| GITLEAKS_ENABLE_SUMMARY: "true" |