ci: CI-gate gitleaks (scan secrets au push)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-22 23:04:58 +02:00
parent 29bda37948
commit d2f79c049b
2 changed files with 44 additions and 0 deletions
@@ -0,0 +1,17 @@
+name: Gitleaks (secret scan)
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Secret scan (gitleaks)
+        run: |
+          set -e
+          curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz | tar xz gitleaks
+          ./gitleaks detect --source . -c .gitleaks.toml --no-git --redact --no-banner --exit-code 1
+          echo "✓ aucun secret détecté"