ci: run gitleaks on every PR, not only in the weekly sweep - #89
Merged
Conversation
aml-filter was the only repo in the portfolio whose secret scan never ran on a pull request. gitleaks lived solely in security-audit.yml, which triggers on `schedule` + `workflow_dispatch` — so a secret committed in a PR merged to main and sat in the public history for up to seven days before the Monday sweep saw it. Every other repo blocks it at the PR. That gap matters more than a normal test gap because a leaked secret is the one defect a revert does not fix: once it is in the public history the credential is burned and has to be rotated. This repo has already paid that bill once. The weekly sweep stays. It re-scans unchanged history against an updated ruleset, which a push-triggered job never does; the two jobs answer different questions. Same action, same pinned SHA, same .gitleaks.toml as the weekly run, so the two cannot disagree about what counts as a secret. Job id is `gitleaks` to match the check-run name the other seven repos already require. Claim touched: "no secret reaches the public history." Previously enforced up to seven days late; now enforced before merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186xrrT9mYfCZTVkk8HN12p
This was referenced Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gap
aml-filterwas the only repo in the portfolio whose secret scan never ran on a pull request.gitleakslived only insecurity-audit.yml, which triggers onschedule+workflow_dispatch. A secret committed in a PR merged tomainand then sat in the public history for up to seven days until the Monday 09:00 UTC sweep. Every other repo blocks it at the PR:gitleaksgitleaksSecret Scan (gitleaks)gitleaksThis matters more than an ordinary missing test. A leaked secret is the one defect a revert does not fix: once it is in the public history the credential is burned and must be rotated. This repo has already paid that bill once.
The change
One new
gitleaksjob inci.yml. Same action, same pinned SHA (e0c47f4fv3), same.gitleaks.tomlas the weekly run, so the two cannot disagree about what counts as a secret.fetch-depth: 0because gitleaks scans every commit, not just HEAD.The weekly sweep stays. It re-scans unchanged history against an updated ruleset, which a push-triggered job never does. The two answer different questions.
Job id is
gitleaks(noname:) so the check-run context matches what the other seven repos already require, and can be added to this repo's branch protection.Claim touched
"No secret reaches the public history." Previously enforced up to seven days late; now enforced before merge.