Repository navigation
ci(security): add org secret scan and pre-publish guard - #504
Merged
Merged
Conversation
Pin the shared QuantStrategyLab/.github scan at 0da4da68 and scan data-branch content before push.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Pigbibi
marked this pull request as ready for review
November 1, 2026 16:22
Pigbibi
added
the
owner-approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI assistance
Grok Bot / Codex coordinated change by 云端运维对账 on behalf of Li SiYi.
What changed
Adds the org shared secret scan (QuantStrategyLab/.github #29, squash 0da4da68, pinned by full SHA):
required-gitleaks.yml: PR + push to main; check nameSecret scan / Gitleaks.weekly-gitleaks.yml: Mon 04:23 UTC, all branches and full history (covers logs/state).Gitleaksjob is kept so the dependabot gate list stays valid. The fee-schedule bump only rewrites date pins and goes through a PR that runs the PR scan.The existing
Gitleaksjob is untouched. Making the new check required is a separate settings step, done after it is green on main.How verified
actionlint on all workflows: clean. No secrets read or printed. CI results below once run.
Why
A secret reached a public logs branch because no scan guarded non-PR publishing. See the org leak root-cause work.
Risk
Tier: workflow change (needs owner-approved label per risk-gate). Publishing path now fails closed if the scan finds a secret; weekly scan only reads.