From 78348d37cb93710f2115ddffcb76359a087a8a97 Mon Sep 17 00:00:00 2001 From: Gadget Lab Date: Mon, 24 Aug 2026 02:56:12 +0000 Subject: [PATCH] fix(ci): bump gitleaks-action v2 -> v3 (Node 24 runtime) v3.0.0 is a Node 20 -> Node 24 runtime migration: "No changes to inputs, outputs, or behavior." Node 24 became the default runtime for JavaScript actions on 2026-06-16 and Node 20 leaves the runners in fall 2026. No GITLEAKS_LICENSE is required here. The action's README scopes the license to organization accounts: "If you are scanning repos that belong to a personal account, then no license key is required." This repo's owner is type User. Evidence the bump is safe: v2 runs green on main today with no license (run 32684406753, job "Secret Detection (Gitleaks)" success), and v3 changes no behavior. Supersedes the equivalent change stranded in draft PR #260, which also added an unnecessary GITLEAKS_LICENSE env line. Omitted here deliberately. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013JdYCSp4nmVgsNWuwNkUaZ --- .github/workflows/security_scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index 0211fe9..aa6d457 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -173,7 +173,7 @@ jobs: fetch-depth: 0 - name: Run Gitleaks - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}