From 1b1e02efe4503154cc4d8258b3bf1438fdde43a8 Mon Sep 17 00:00:00 2001 From: rabbitblood Date: Sun, 26 Apr 2026 20:09:17 -0700 Subject: [PATCH] chore(ci): enroll in org-wide secret-scan reusable workflow (Molecule-AI/molecule-core#2109) --- .github/workflows/secret-scan.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/secret-scan.yml diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml new file mode 100644 index 0000000..4272f18 --- /dev/null +++ b/.github/workflows/secret-scan.yml @@ -0,0 +1,22 @@ +name: Secret scan + +# Calls the canonical reusable workflow in molecule-core. Defense +# against the #2090-class leak (a hosted-agent commit slipping a +# credential-shaped string into a PR). Pattern set lives in +# molecule-core so we do not maintain a parallel copy here. +# +# Pinned to @staging because that is the active default branch on the +# upstream repo (main lags behind via the staging-promotion workflow). +# Updates ride along automatically as the upstream regex set evolves. + +on: + pull_request: + types: [opened, synchronize, reopened] + push: + branches: [main, staging, master] + merge_group: + types: [checks_requested] + +jobs: + secret-scan: + uses: Molecule-AI/molecule-core/.github/workflows/secret-scan.yml@staging