Files

26 lines
716 B
YAML

name: full-history secret scan
on:
schedule:
- cron: "17 3 * * 1"
workflow_dispatch:
permissions:
contents: read
jobs:
gitleaks:
name: gitleaks (full history)
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
# workflow_dispatch and schedule events make this pinned action scan the
# complete reachable history. Push/PR scans remain differential in ci.yml.
- uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_CONFIG: .gitleaks.toml