secrets-precommit.yml

name: Secrets Pre-commit

# Reusable CI gate that runs Gitleaks on a PR so contributors without the
# local pre-commit hook are still blocked from merging secrets.
#
# Deliberately does NOT use step-security/harden-runner: this workflow runs in
# the caller's context and may be consumed by private repos where third-party
# CI telemetry is not acceptable. See docs/approved-actions.md.

on:
  workflow_call:
    inputs:
      fail-on-finding:
        description: 'Hard-fail the workflow on any secret finding'
        default: true
        type: boolean
      config-path:
        description: 'Path to .gitleaks.toml config in consuming repo (optional)'
        default: '.gitleaks.toml'
        type: string
      actions-ref:
        description: >-
          Ref or commit SHA of sparkgeo/github-actions to load the gitleaks
          composite from. Pin this to the SAME SHA you pinned
          secrets-precommit.yml to, so the whole workflow is immutable.
        default: 'main'
        type: string

permissions:
  contents: read

jobs:
  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository under test
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0  # full history so the PR commit range can be scanned

      # Load the composite action at the caller-pinned ref into a fixed path,
      # then invoke it locally. This keeps the action reference immutable
      # (no mutable cross-repo @main) while honouring the repo's SHA-pin policy.
      - name: Checkout gitleaks composite action
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          repository: sparkgeo/github-actions
          ref: ${{ inputs.actions-ref }}
          path: .sparkgeo-github-actions
          persist-credentials: false

      - uses: ./.sparkgeo-github-actions/.github/actions/gitleaks
        with:
          config-path: ${{ inputs.config-path }}
          fail-on-finding: ${{ inputs.fail-on-finding }}