ci: scan range histories

2026-06-23 02:37:55 +00:00
parent be5abaec51
commit 9ac1eba4bf
1 changed files with 5 additions and 1 deletions
@@ -33,7 +33,11 @@ jobs:
          mv gitleaks /usr/local/bin/gitleaks
      - name: Run secret scan
-        run: gitleaks detect --source . --exit-code 1 --redact --verbose --log-level debug
+        # Scan only the commits this PR introduces (base..head), not the whole history.
        run: |
          gitleaks detect --source . \
            --log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" \
            --exit-code 1 --redact --verbose --log-level debug
  # ── 2. CVE scan ───────────────────────────────────────────────────────────────
  trivy: