build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the actions group #14

	name: Secret Scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: secrets-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	gitleaks:
	name: gitleaks
	runs-on: ubuntu-latest
	steps:
	- uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	egress-policy: audit
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	fetch-depth: 0 # scan full history
	persist-credentials: false
	# The gitleaks GitHub Action requires a paid license for org accounts, but
	# the gitleaks binary itself is free (MIT). Run it directly.
	- name: Install gitleaks
	env:
	GITLEAKS_VERSION: "8.30.1"
	run: \|
	curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
	\| tar -xz -C /usr/local/bin gitleaks
	gitleaks version
	- name: Scan repository
	# --config points at the repo allowlist (.gitleaks.toml), which extends
	# the default ruleset and excludes the redaction unit-test fixtures that
	# intentionally embed fake secret-shaped strings.
	run: gitleaks dir . --config .gitleaks.toml --redact --verbose --exit-code 1

Provide feedback