deps: bump the production-deps group across 1 directory with 71 updates #4958

	---
	name: CI
	on:
	- push
	- pull_request

	# Default to no permissions; each job declares only what it needs
	permissions: {}

	# Cancel in-progress runs for the same branch/PR to save resources
	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	build:
	permissions:
	contents: read
	uses: ./.github/workflows/build.yml
	secrets: inherit

	# Pre-merge secret scan. Catches accidentally-committed tokens, signing
	# keys, etc. before they hit main. Uses the gitleaks CLI directly (MIT-
	# licensed, no license key needed) instead of gitleaks-action, which
	# requires a paid GITLEAKS_LICENSE for organization-owned repositories.
	secret-scan:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	permissions:
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Install gitleaks
	run: \|
	GITLEAKS_VERSION="8.24.3"
	curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
	\| sudo tar -xz -C /usr/local/bin gitleaks
	gitleaks version

	- name: Run gitleaks
	run: \|
	BASE="${{ github.event.before \|\| github.event.pull_request.base.sha }}"
	NULL_SHA="0000000000000000000000000000000000000000"
	if [ -z "$BASE" ] \|\| [ "$BASE" = "$NULL_SHA" ]; then
	# New branch, tag, or force-push — scan the full history
	gitleaks detect --source . --verbose
	else
	gitleaks detect --source . --verbose --log-opts="${BASE}..HEAD"
	fi

Navigation Menu