Repository navigation
docs(feature-map): keep the page's sources in the repo; npm run docs:feature-map #1536
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| # PR: scan only new commits (diff mode) — fast. | |
| # Push to main / weekly schedule: scan full repository history — thorough. | |
| # Findings are uploaded to the GitHub Security tab as SARIF (best-effort on private repos). | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Full history scan every Monday at 01:00 UTC. | |
| - cron: '0 1 * * 1' | |
| permissions: | |
| contents: read | |
| security-events: write # required to upload SARIF to the Security tab | |
| jobs: | |
| gitleaks: | |
| # A version-bump commit changes four package.json version fields and | |
| # nothing else, so there is nothing here for it to check. It used to carry | |
| # `[skip ci]` for this, but that marker also suppresses the *tag* push that | |
| # rides on the same commit, which silently disabled every release — see | |
| # version-bump.yml. Skipping by message keeps the saving without that cost. | |
| # Guarded on event_name so pull_request runs are never skipped. | |
| if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}" | |
| name: Gitleaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| # Full history required for push/schedule scans. | |
| # PR scans only need the tip but fetch-depth: 0 is safe for both. | |
| fetch-depth: 0 | |
| - name: Install Gitleaks | |
| env: | |
| GITLEAKS_VERSION: "8.21.2" | |
| run: | | |
| curl -sSfL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| # PR mode: scan only commits introduced by this PR (fast, no history noise). | |
| - name: Scan PR diff | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| gitleaks detect \ | |
| --source . \ | |
| --config .gitleaks.toml \ | |
| --redact \ | |
| --report-format sarif \ | |
| --report-path gitleaks.sarif \ | |
| --log-opts "origin/${{ github.base_ref }}...HEAD" | |
| # Push / schedule: scan the full commit history. | |
| - name: Scan full history | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| gitleaks detect \ | |
| --source . \ | |
| --config .gitleaks.toml \ | |
| --redact \ | |
| --report-format sarif \ | |
| --report-path gitleaks.sarif | |
| # Upload findings to GitHub Security tab. | |
| # continue-on-error: private repos need GitHub Advanced Security for the | |
| # Code Scanning API — the scan itself still blocks on leaks found above. | |
| - name: Upload SARIF to GitHub Security | |
| if: always() | |
| continue-on-error: true | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: gitleaks.sarif | |
| category: gitleaks |