From 36f2e0e6a57279ae4090c2f3b5e2116773f48466 Mon Sep 17 00:00:00 2001 From: Paul Bezilla Date: Sun, 6 Sep 2026 10:37:28 -0600 Subject: [PATCH] Name the gitleaks step for the range it actually scans The step was called "gitleaks over full history" and never scanned full history on either trigger: the action reads the commit range of the event, one commit on a pull request and the pushed range on a push, against 41 on main. fetch-depth: 0 makes that range resolvable rather than wider. Full history is the identity job's --all-history run. The job name, and so the required check context, is unchanged. --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e464de6..6b5256a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,7 +116,12 @@ jobs: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 - - name: gitleaks over full history + # Named for what it does. The action scans the commit range of the + # event -- one commit on a pull request, the pushed range on a push -- + # not the whole repository; fetch-depth: 0 makes that range resolvable, + # it does not widen it. Full history is covered by the identity job, + # which runs the pre-push gate in its --all-history mode. + - name: gitleaks over the pushed range uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 env: # The action refuses to scan a pull_request event without this and