fix(web): hide Linked Profiles tab on unlinked devices (#2865) (#2867) #5856

	name: Secret Scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	gitleaks:
	name: Gitleaks
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false

	- name: Install gitleaks
	run: \|
	set -euo pipefail
	version="8.21.2"
	asset="gitleaks_${version}_linux_x64.tar.gz"
	checksums="gitleaks_${version}_checksums.txt"
	base_url="https://github.com/gitleaks/gitleaks/releases/download/v${version}"
	workdir="$(mktemp -d)"
	trap 'rm -rf "$workdir"' EXIT

	curl -sSfL -o "$workdir/$asset" "$base_url/$asset"
	curl -sSfL -o "$workdir/$checksums" "$base_url/$checksums"
	(cd "$workdir" && grep " ${asset}$" "$checksums" \| sha256sum -c -)
	tar -xzf "$workdir/$asset" -C "$workdir" gitleaks
	sudo install -m 0755 "$workdir/gitleaks" /usr/local/bin/gitleaks

	- name: Run gitleaks
	run: gitleaks detect --source . --verbose

	confidential-patterns:
	name: Confidential patterns (PR-safe)
	if: github.event_name == 'pull_request'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false

	# Keep the high-signal, secret-free pattern checks on untrusted PRs.
	# Exact confidential values remain isolated to the trusted push workflow.
	- name: Scan for confidential patterns
	run: bash scripts/security/scan-confidential.sh --all

Navigation Menu