feat(runner): isolate structured workflows in one-attempt Kubernetes Pods #1241
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Standalone gitleaks scan. Runs on every push to every source branch | |
| # AND on every pull request (including from forks). Intentionally decoupled | |
| # from ci.yml so it executes fast, is independent of the release pipeline | |
| # (release-please.yml), and covers branches that currently have no push-time | |
| # CI (chore/**, docs/**, ci/**, test/**). | |
| # | |
| # Why `pull_request` (not `pull_request_target`): fork PRs need secret | |
| # scanning, and `pull_request` checks out the fork's code in the base-repo | |
| # context WITHOUT exposing base-repo secrets to fork code: gitleaks only | |
| # reads files, so this is safe. `pull_request_target` would run the fork's | |
| # workflow definition with write-scoped secrets, which is the dangerous | |
| # pattern we explicitly avoid. | |
| name: Secrets Scan | |
| on: | |
| push: | |
| # gh-pages is MkDocs build output; it would only surface false | |
| # positives mirroring docs/SETUP.md placeholders. The .gitleaks.toml | |
| # allowlist covers those paths already, but skipping the branch | |
| # entirely saves runner minutes on every docs deploy. | |
| branches-ignore: | |
| - gh-pages | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: secrets-scan-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks | |
| # Pinned per project convention: see CLAUDE.md "CI/CD Pipeline" note | |
| # on avoiding ubuntu-latest so a rolling alias can't silently flip. | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| # For `push` events gitleaks-action scans the push range | |
| # (GITHUB_EVENT_BEFORE..GITHUB_SHA), which needs enough depth | |
| # to cover the delta. 0 = full history: simplest and safe. | |
| # For `workflow_dispatch` this enables an on-demand full audit. | |
| fetch-depth: 0 | |
| - name: Scan for secrets | |
| uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| # gitleaks-action@v2.3.9 bundles 8.24.3 which has [[allowlists]] | |
| # bugs that misfire on docs/SETUP.md. 8.30.1 has the fix. | |
| GITLEAKS_VERSION: "8.30.1" |