From 193971093d233bb8ae12c3ff731e68cfe7d085c2 Mon Sep 17 00:00:00 2001 From: iam-truongtrungnghia <149591043+ttncode@users.noreply.github.com> Date: Sat, 12 Sep 2026 13:10:52 +0700 Subject: [PATCH] fix: scan for secrets with the version the project pins gitleaks-action builds its scan range as ^... On a repository's first push that is the root commit, which has no parent, so git fails, the scan covers zero bytes, and the action still reports 'no leaks found'. Reproduced deterministically. It also installed gitleaks 8.24.3 while generated projects pin 8.30.0 for their commit hook. Running the project's own task scans the whole history with one version, the way every other tool here already runs. --- .github/workflows/app-security.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/app-security.yml b/.github/workflows/app-security.yml index fb595a0..b908eac 100644 --- a/.github/workflows/app-security.yml +++ b/.github/workflows/app-security.yml @@ -84,14 +84,10 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - # gitleaks-action reads the pull request's commits through the API - # (GET .../pulls/{n}/commits) instead of the diff already on disk. - pull-requests: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 - env: - GITHUB_TOKEN: ${{ github.token }} + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - run: mise run secrets