From 83029320f53177ed0959c9f1dbaa6a56a1416e5b Mon Sep 17 00:00:00 2001
From: ernestprovo23 <ernest@thedataexperts.us>
Date: Mon, 8 Jun 2026 21:59:28 -0400
Subject: [PATCH 1/2] ci(gitleaks): add secret-scan workflow on push + PR
 (PR-D)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Uses gitleaks/gitleaks-action@v2 with full history fetch (fetch-depth=0)
to scan for leaked secrets. Hard-fail check — this is the BYO-keys trust
signal: conclave reads keys from env vars only and this gate enforces that
no credentials ever land in the tree.
---
 .github/workflows/gitleaks.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/gitleaks.yml

diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 0000000..bd0c6e0
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,21 @@
+name: Gitleaks
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+jobs:
+  gitleaks:
+    name: "gitleaks"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan for secrets
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 67d3bb1cffb88377c59d8409314b6b6dadeaefeb Mon Sep 17 00:00:00 2001
From: ernestprovo23 <ernest@thedataexperts.us>
Date: Mon, 8 Jun 2026 22:00:36 -0400
Subject: [PATCH 2/2] fix(gitleaks): upgrade to v3, add pull-requests: read
 permission

gitleaks-action@v2 calls the GitHub API to list PR commits but requires
pull_requests=read which the default token doesn't grant without an explicit
permissions block. v3 also resolves the Node.js 20 deprecation warning.
---
 .github/workflows/gitleaks.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index bd0c6e0..c80c988 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -5,6 +5,10 @@ on:
     branches: ["main"]
   pull_request:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   gitleaks:
     name: "gitleaks"
@@ -16,6 +20,6 @@ jobs:
           fetch-depth: 0
 
       - name: Scan for secrets
-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}