name: Secret Scan

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]

jobs:
  secret-scan:
    name: Scan for secrets and sensitive config
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0   # full history for gitleaks git-log scan

      - name: Install gitleaks
        run: |
          GITLEAKS_VERSION="8.21.2"
          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - name: Run secret scan
        run: bash scripts/check-secrets.sh