forked from eramdam/eslint-plugin-top
-
Notifications
You must be signed in to change notification settings - Fork 3
38 lines (36 loc) · 1.06 KB
/
secrets.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
name: Secrets
on:
pull_request: ~
push:
branches:
- main
schedule:
- cron: '0 3 * * *'
workflow_dispatch: ~
permissions: read-all
jobs:
secrets:
name: Secrets
runs-on: ubuntu-22.04
steps:
- name: Harden runner
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
actions-results-receiver-production.githubapp.com:443
api.github.com:443
artifactcache.actions.githubusercontent.com:443
ghcr.io:443
github.com:443
objects.githubusercontent.com:443
pkg-containers.githubusercontent.com:443
- name: Checkout repository
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
with:
fetch-depth: 0
- name: Secret Scanning
uses: trufflesecurity/trufflehog@da25ac2e7f7eef8c2daf1f8b6dae34e780c7fd96 # v3.76.3
with:
extra_args: --only-verified