name: Gitleaks (secret scan)
on:
  push:
    branches: [main]
  workflow_dispatch: {}
jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Secret scan (gitleaks)
        run: |
          set -e
          curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz | tar xz gitleaks
          ./gitleaks detect --source . -c .gitleaks.toml --no-git --redact --no-banner --exit-code 1
          echo "✓ aucun secret détecté"