---
name: Gitleaks
"on":
    push:
    pull_request:
    workflow_dispatch:
    schedule:
        - cron: "0 4 * * *" # run once a day at 4 AM

jobs:
    gitleaks:
        permissions: write-all
        name: gitleaks
        runs-on: any
        steps:
            - uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  fetch-depth: 0

            - name: Run Gitleaks
              run: gitleaks detect --source . --report-format json --report-path gitleaks-secrets.json

            - name: Archive Gitleaks Report
              # v3.2.0-node20 # https://gitea.com/actions/upload-artifact#v4---whats-new
              uses: github-mirrors/upload-artifact@672174a5bad8453f715436e010047cb8fa7680be
              if: always()
              with:
                  name: gitleaks-secrets
                  path: gitleaks-secrets.json