Repository navigation

Security #2

	name: Security
	# Push CI scans only the latest commits, so a secret committed earlier and later
	# removed would never be seen again. This is the full-history counterpart: same
	# pinned scanners, whole history, no reports to parse — a finding fails the job.
	on:
	schedule:
	- cron: "17 3 * * 1"
	workflow_dispatch:
	permissions:
	contents: read
	concurrency:
	group: security
	cancel-in-progress: true
	jobs:
	scan:
	name: Full-history scan
	runs-on: ubuntu-24.04
	timeout-minutes: 30
	steps:
	- name: Checkout complete history
	uses: actions/checkout@v7
	with:
	fetch-depth: 0
	persist-credentials: false # scanners only read the checkout
	- name: Install mise system
	uses: jdx/mise-action@v4
	- name: Scan complete Git history
	run: gitleaks git --redact=100 --verbose
	- name: Scan full checkout
	run: trivy fs .