security.yml

name: Security
# Push CI scans only the latest commits, so a secret committed earlier and later
# removed would never be seen again. This is the full-history counterpart: same
# pinned scanners, whole history, no reports to parse — a finding fails the job.
on:
  schedule:
    - cron: "17 3 * * 1"
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: security
  cancel-in-progress: true
jobs:
  scan:
    name: Full-history scan
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout complete history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false # scanners only read the checkout
      - name: Install mise system
        uses: jdx/mise-action@v4
      - name: Scan complete Git history
        run: gitleaks git --redact=100 --verbose
      - name: Scan full checkout
        run: trivy fs .