chore(release): reconcile platform BOM #190

	name: Secret Scan

	# SOC 2: secret scanning (OA-C-24). Uses the free, MIT-licensed gitleaks CLI.
	# NOTE: the gitleaks Action now requires a paid GITLEAKS_LICENSE for
	# organization-owned repos (even public ones); the gitleaks CLI does not, so we
	# invoke it directly and pin the version. Scans full git history on PRs + main.
	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	gitleaks:
	name: gitleaks
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	fetch-depth: 0
	- name: Install gitleaks
	env:
	GITLEAKS_VERSION: 8.30.1
	run: \|
	curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
	\| tar -xz -C /usr/local/bin gitleaks
	gitleaks version
	- name: Scan git history for secrets
	# --config pins the baseline (.gitleaks.toml) that scopes one known,
	# pre-existing historical finding; all new commits are still fully scanned.
	run: gitleaks git . --config .gitleaks.toml --redact --no-banner

Navigation Menu