Repository navigation
Merge pull request #2939 from sap-tutorials/version-bump-1.41.6 #3123
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: no committed secrets check | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, DEV] | |
| # #887 backstop. If a doc revert or a copy-paste from an old branch ever | |
| # reintroduces a known-exposed secret literal, this check fails the build | |
| # instead of silently reopening the vulnerability. | |
| # | |
| # The tripwire list is deliberately narrow — it's for post-rotation values, | |
| # not general secret scanning (use gitleaks/trufflehog for that). See | |
| # scripts/check-no-committed-secrets.js for the current list. | |
| jobs: | |
| check-no-committed-secrets: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: Scan for known-exposed secret values | |
| run: node scripts/check-no-committed-secrets.js |