secret-scan.yml

name: Secret scan

on:
  pull_request:
  push:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *" # run once a day at 4 AM UTC

env:
  PYTHON_VERSION: "3.12"

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install pre-commit
        run: pip install pre-commit

      - name: Scan for secrets
        run: pre-commit run gitleaks --all-files