Sulkta-OSS/carrier
3
0
Fork 0
Code Issues 1 Pull requests 3 Projects Releases Packages Wiki Activity Actions

docs: public README + generic gitleaks workflow header

Browse source
This commit is contained in:
Sulkta 2026-06-28 13:25:28 -07:00
parent 623cb07ffc
commit 757c591552
2 changed files with 92 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

17
.forgejo/workflows/gitleaks.yml
View file

@ -1,16 +1,9 @@
# .forgejo/workflows/gitleaks.yml
# gitleaks secret-scan workflow.
#
# Reusable gitleaks secret-scan workflow. Drop a copy into every public repo at
# `.forgejo/workflows/gitleaks.yml` after the Forgejo act_runner is registered
# .
#
# Pairs with the pre-receive hook installed on every bare repo — that one is
# the strict enforcement layer (rejects the push); this one provides the
# per-PR red ✗ that branch-protection rules can require before merge.
#
# Layer 1 (this workflow): visible per-PR status, can be a required check.
# Layer 2 (pre-receive hook): strict enforcement at the server.
# Layer 3 (scheduled cron sweep): nightly full-history sweep across all repos.
# Runs gitleaks on every push and pull request to catch committed secrets.
# Wire it up as a required status check via branch-protection rules so a
# leaking PR cannot be merged. Compatible with Forgejo/Gitea Actions and
# GitHub Actions runners.
name: gitleaks