name: gitleaks

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0 # full history — gitleaks scans every commit

      - name: Install gitleaks
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download v8.30.1 --repo gitleaks/gitleaks \
            --pattern '*linux_x64.tar.gz' --output gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz gitleaks

      - name: Scan full history
        run: ./gitleaks git . --no-banner --redact