secrets.yml

name: Secrets
on:
  pull_request: ~
  push:
    branches:
      - main
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch: ~

permissions: read-all

jobs:
  secrets:
    name: Secrets
    runs-on: ubuntu-24.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            ghcr.io:443
            github.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Scan for secrets
        uses: trufflesecurity/trufflehog@4d355d414e2d6c674bcebfe40cb648e22f6457ae # v3.83.1
        with:
          extra_args: --only-verified