secret-scanner.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: AGPL-3.0-or-later
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: Secret Scanner

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read

jobs:
  scan:
    # caller must grant at least that or the run startup-fails.
    permissions:
      contents: read
    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570)
    secrets: inherit