From 356fbfa942e77ec5a35cff654319a755a299e865 Mon Sep 17 00:00:00 2001
From: bboysoul <bboysoulcn@gmail.com>
Date: Tue, 8 Sep 2026 11:10:34 +0800
Subject: [PATCH] ci: scan Git history with gitleaks

---
 .gitea/workflows/ci.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0f57112..63f2772 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches:
       - "main"
+  pull_request:
+    branches:
+      - "main"
 
 env:
   APP_NAME: aws-dodo
@@ -17,7 +20,32 @@ env:
   ARGOCD_URL: argocd.bboysoul.cn
 
 jobs:
+  gitleaks:
+    runs-on: docker
+    container:
+      options: --user=root
+    steps:
+      - name: Check out repository history
+        uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan Git history for secrets
+        shell: bash
+        run: |
+          set -euo pipefail
+          GITLEAKS_VERSION=8.30.1
+          ARCHIVE="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl --fail --silent --show-error --location \
+            --output "/tmp/${ARCHIVE}" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${ARCHIVE}"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/${ARCHIVE}" | sha256sum --check --strict
+          tar -xzf "/tmp/${ARCHIVE}" -C /usr/local/bin gitleaks
+          gitleaks git --redact --no-banner --verbose --log-opts="--all" .
+
   docker:
+    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+    needs: gitleaks
     runs-on: docker
     container:
       options: --user=root