secrets.yml

# Nothing committed here that should not be.
#
# This repository is public, so a credential that reaches it is not a mistake that can be quietly
# corrected: it is readable by everybody from the moment it is pushed, and the only honest response
# is to withdraw the credential itself. This is the check that catches one before that happens.
#
# The whole history is scanned rather than the working tree. A key deleted in a later commit is
# still a key anybody can read out of an earlier one, so a scan of the current files answers the
# wrong question.
#
# gitleaks is run as its own published binary rather than through the ready-made action. The action
# asks an organisation to sign up for a licence key and keep it as a repository secret, which is a
# credential added in order to look for credentials; the tool itself is MIT and needs nothing. The
# version and the checksum are both pinned here, so this step fetches one exact file and refuses
# anything else — a supply chain of one line that can be read.

name: Secrets

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: secrets-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  scan:
    name: Scan the history
    runs-on: ubuntu-latest

    env:
      GITLEAKS_VERSION: 8.30.1
      GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb

    steps:
      - uses: actions/checkout@v7
        with:
          # Every commit, not the tip. Without this the checkout is a single commit deep and the
          # scan below has almost nothing to read.
          fetch-depth: 0

      - name: Fetch gitleaks
        run: |
          set -euo pipefail
          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          curl --fail --silent --show-error --location \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}" \
            --output "$archive"
          echo "${GITLEAKS_SHA256}  ${archive}" | sha256sum --check --strict
          tar --extract --gzip --file "$archive" gitleaks
          rm "$archive"

      # --redact so that a finding is reported as a file, a line and a rule without reprinting the
      # credential into a build log, which is a second public place it would then exist.
      #
      # What the scan is allowed to pass over is in .gitleaks.toml, beside this file and reviewed
      # like anything else.
      - name: Scan
        run: ./gitleaks git . --redact --verbose --no-banner