From 2cddfaf8591b41cb6b9b9906e47760ed657f0a48 Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Mon, 6 Jul 2026 14:22:38 -0700 Subject: [PATCH 1/7] Create secret-scan.yml for Gitleaks integration Add GitHub Actions workflow for secret scanning using Gitleaks. --- .github/workflows/secret-scan.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/secret-scan.yml diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml new file mode 100644 index 0000000..33df52e --- /dev/null +++ b/.github/workflows/secret-scan.yml @@ -0,0 +1,14 @@ +name: Secret Scan + +on: + pull_request: + push: + +jobs: + gitleaks: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - uses: gitleaks/gitleaks-action@v2 From e20ec9cde85996212eeb87a2c388ad7b2d3b0508 Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Mon, 6 Jul 2026 14:28:03 -0700 Subject: [PATCH 2/7] Add GITHUB_TOKEN --- .github/workflows/secret-scan.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 33df52e..8c145ee 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -11,4 +11,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: gitleaks/gitleaks-action@v2 + - name: Gitleaks + uses: gitleaks/gitleaks-action@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From e93e26df76b9b35632c9dcf2597d9884680726eb Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Mon, 6 Jul 2026 14:31:37 -0700 Subject: [PATCH 3/7] Add workflow_dispatch trigger to secret scan --- .github/workflows/secret-scan.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 8c145ee..6b5cd3e 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -3,15 +3,22 @@ name: Secret Scan on: pull_request: push: + workflow_dispatch: jobs: - gitleaks: + secret-scan: runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 - - name: Gitleaks - uses: gitleaks/gitleaks-action@v2 + - name: Run Gitleaks + uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From c292c4ab33e0374d53181561bb607317bc6afedd Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Mon, 6 Jul 2026 14:38:38 -0700 Subject: [PATCH 4/7] Add pinned commit SHA --- .github/workflows/secret-scan.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 6b5cd3e..9992e56 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -5,20 +5,21 @@ on: push: workflow_dispatch: +permissions: + contents: read + security-events: write + jobs: - secret-scan: + gitleaks: runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Run Gitleaks - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@2cddfaf8591b41cb6b9b9906e47760ed657f0a48 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From b317896ab9f7156f3525e21be767cff8dc19dfb6 Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Mon, 6 Jul 2026 14:40:20 -0700 Subject: [PATCH 5/7] Update Gitleaks action to use version v2 --- .github/workflows/secret-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 9992e56..b7a7f93 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -20,6 +20,6 @@ jobs: fetch-depth: 0 - name: Run Gitleaks - uses: gitleaks/gitleaks-action@2cddfaf8591b41cb6b9b9906e47760ed657f0a48 + uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From dd0c022125c162c603c0ff44461f3ea0073a7523 Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Tue, 7 Jul 2026 00:51:34 -0700 Subject: [PATCH 6/7] Upgrade to v3 and checkout@v6 --- .github/workflows/secret-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index b7a7f93..bf6d314 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -15,11 +15,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Run Gitleaks - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 557ef32bb561a68d3c6dc478b25cbffb0af66871 Mon Sep 17 00:00:00 2001 From: Lei Jiang Date: Tue, 7 Jul 2026 00:53:43 -0700 Subject: [PATCH 7/7] Add GITLEAKS_LICENSE to secret-scan workflow --- .github/workflows/secret-scan.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index bf6d314..0a6176b 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -23,3 +23,4 @@ jobs: uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}