Secret Scan #4

	# Secret scanning workflow for OperatorOne
	# Uses gitleaks to prevent accidental commit of secrets
	# Config: .gitleaks.toml \| Suppressions: .gitleaksignore

	name: Secret Scan

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]
	schedule:
	# Full repo scan every Sunday at 03:00 UTC
	- cron: "0 3 * * 0"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	gitleaks:
	name: Scan for secrets
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Run gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback