[shubham-s-pandey]

Summary

Add a Betterleaks secret-scanning workflow for pull requests and pushes to the default branch.

Scope

• Scans the complete Git history.
• Keeps the repository configuration small and reviewable.
• Does not require API keys or external services.
• Uses read-only GitHub Actions permissions.
• Does not remove or modify any existing scanner.

Validation

• Workflow runs on pull requests.
• Workflow runs on pushes to the default branch.
• Workflow can also be started manually.
• The container image is pinned to v2.0.0-rc.1.

[drk-ram]

Security peer review of commit f6e35a89173c44e60c594c3fa9e4ff766ed7b997.

No exploitable security vulnerability found in the changed workflow or rule configuration. The job uses read-only repository permission, does not persist checkout credentials, and mounts the checkout read-only into a non-root container. It uses the unprivileged pull-request event rather than the privileged target event. Credential validation, analysis, revocation, and environment forwarding are not enabled by the container invocation, so the provider-request expressions are not active in this job. I compared the complete configuration with the official v2.0.0-rc.1 release configuration and inspected the differences.

Tests at that exact commit: 8 in-memory configuration/security checks passed, 0 failed, covering YAML/TOML parsing, all 466 rule identifiers and component references, event privilege, permissions, credential persistence, mount restrictions, invocation arguments, and version agreement. 0 container/scanner execution tests: Docker and the scanner executable are unavailable on this host. This approval is based on the reviewed configuration and those checks, not a claim that the container run was exercised.

[shubham-s-pandey]

• Changed the workflow to use pull_request_target, so the scan logic and Betterleaks configuration come from the trusted base branch rather than the contributor’s PR.
• The pull-request commit is checked out separately under scan-repo and mounted read-only only as scanner input. No code or workflow from the PR is executed.
• Pinned the Betterleaks container to v2.0.0-rc.4 using its immutable SHA-256 digest to prevent silent image changes.
• Updated branch documentation to reference main.
  These changes ensure that contributors cannot disable the security check by modifying the scanner workflow or configuration in their own PR.

[shubham-s-pandey]

@saquibsaifee @eaglei15 Hi team, PR are ready for merge. Could someone please take a final look and merge PR. Thanks!

[saquibsaifee]

@shubham-s-pandey, do you have an issue created for this feature?

[shubham-s-pandey]

@saquibsaifee No, If required I can create an issue for this PR.

[shubham-s-pandey]

@saquibsaifee @eaglei15 Hi team, PR are ready for merge. Could someone please take a final look and merge PR. Thanks!