From 05990a3bd4f225d0ae2201a8dae4e621c34041f8 Mon Sep 17 00:00:00 2001 From: Altay Date: Sat, 12 Sep 2026 03:02:49 +0300 Subject: [PATCH] docs(scan): say what the weekly scan actually catches --- .github/workflows/scan.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index db5bfc0..c733599 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -1,9 +1,11 @@ name: Scan -# No push trigger: the push-to-main pipeline already runs the same shared -# scan as a release gate. Pull requests scan the full history too, because the -# shared baseline checks out with `fetch-depth: 0`; the weekly schedule -# re-scans unchanged code against newer detector rules. +# No push trigger: the push-to-main pipeline already runs the same shared scan +# as a release gate, and pull requests scan the full history because the shared +# baseline checks out with `fetch-depth: 0`. The weekly run is for the scanners +# that consult live state - TruffleHog reports only credentials it can verify, +# and zizmor's online audits read GitHub - so a secret that was inactive at +# commit time is caught once it becomes valid. on: pull_request: schedule: