gitleaks.yml

name: GitLeaks Scan

on:
  pull_request:
  push:
  workflow_dispatch:
  schedule:
    - cron: "12 4 * * *" # run once a day at 4:12 AM

concurrency:
  group: gitleaks-${{ github.ref }}
  cancel-in-progress: false

jobs:
  scan:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # Uncomment if using in an organization