Admin social progress timing and handle indexes #481
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: '0 0 * * 0' # Weekly on Sunday at midnight UTC (full scan) | |
| # Principle of least privilege: only grant permissions actually needed | |
| permissions: | |
| contents: read # Read repo contents | |
| security-events: write # Upload SARIF to GitHub Code Scanning | |
| pull-requests: write # Comment on PRs (optional) | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| # Pinned to v4.2.2 (2025-01-09) for supply chain security | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| with: | |
| # Full history needed for comprehensive scanning | |
| fetch-depth: 0 | |
| - name: Fetch base branch for PR scans | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| git fetch --no-tags --prune --depth=1 origin +refs/heads/${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }} | |
| - name: Run Gitleaks (PR - incremental scan) | |
| if: github.event_name == 'pull_request' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| run: | | |
| # Pinned to v8.21.2 (2024-12-03) for supply chain security | |
| docker run --rm -v $(pwd):/repo ghcr.io/gitleaks/gitleaks:v8.21.2@sha256:0e99e8821643ea5b235718642b93bb32486af9c8162c8b8731f7cbdc951a7f46 \ | |
| detect --redact --source=/repo \ | |
| --log-opts="origin/${{ github.base_ref }}..HEAD" \ | |
| --report-format sarif --report-path /repo/gitleaks.sarif \ | |
| --exit-code 1 | |
| - name: Run Gitleaks (Push/Schedule - full history scan) | |
| if: github.event_name != 'pull_request' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| run: | | |
| # Pinned to v8.21.2 (2024-12-03) for supply chain security | |
| docker run --rm -v $(pwd):/repo ghcr.io/gitleaks/gitleaks:v8.21.2@sha256:0e99e8821643ea5b235718642b93bb32486af9c8162c8b8731f7cbdc951a7f46 \ | |
| detect --redact --source=/repo \ | |
| --report-format sarif --report-path /repo/gitleaks.sarif \ | |
| --exit-code 1 | |
| - name: Upload SARIF to GitHub Code Scanning | |
| # Only upload on same-repo PRs or non-PR events (fork PRs lack token permissions) | |
| if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) | |
| # Pinned to v3.27.0 (2024-12-18) for supply chain security | |
| uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd | |
| with: | |
| sarif_file: gitleaks.sarif | |
| category: gitleaks | |
| - name: Upload Gitleaks report artifact | |
| if: always() | |
| # Pinned to v4.5.0 (2024-12-12) for supply chain security | |
| uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b | |
| with: | |
| name: gitleaks-report-${{ github.event_name }} | |
| path: gitleaks.sarif | |
| retention-days: 30 |