Repository navigation

Merge pull request #2939 from sap-tutorials/version-bump-1.41.6 #2629

	name: secret scan (gitleaks)

	on:
	pull_request:
	push:
	branches: [main, DEV]

	# Broad secret scanning — complements the narrow known-value tripwire in
	# `no-committed-secrets-check.yml` (scripts/check-no-committed-secrets.js).
	# That tripwire only catches specific post-rotation literals; gitleaks catches
	# NEW secrets (API keys, tokens, PATs) by pattern before they land on main.
	#
	# Runs the gitleaks binary directly (Apache-2.0) rather than the official
	# gitleaks-action, which requires a paid GITLEAKS_LICENSE for orgs scanning
	# PRIVATE repos. The binary needs no license.
	#
	# On a PR it scans the PR's commit range; on a push to main it scans the full
	# history so a secret can never be merged silently. Config + allowlist live in
	# .gitleaks.toml.

	jobs:
	gitleaks:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@v4
	with:
	# Full history so gitleaks can scan every commit, not just the tip.
	fetch-depth: 0
	- name: Install gitleaks
	run: \|
	set -euo pipefail
	VERSION=8.21.2
	curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
	\| tar -xz -C /usr/local/bin gitleaks
	gitleaks version
	- name: Scan for secrets
	run: gitleaks detect --source . --config .gitleaks.toml --redact --verbose --no-banner