secret-scanner.yml

# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
# shell-secrets). Added because this repository had NO leak scanning at all.
#
# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner
# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
name: "Secret Scanner"
on:
  pull_request:
  push:
    branches: [main, master]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  actions: read
  contents: read
jobs:
  secret-scan:
    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
    secrets: inherit