fortress-security-scans.yml

# ------------------------------------------------------------------------------------
#  Security Scans (Reusable Workflow) (GoFortress)
#
#  Purpose: Run all security scanning tools including Nancy (dependency checks),
#  Govulncheck (Go vulnerability scanning), and Gitleaks (secret scanning).
#
#  Maintainer: @mrz1836
#
# ------------------------------------------------------------------------------------

name: GoFortress (Security Scans)

on:
  workflow_call:
    inputs:
      env-json:
        description: "JSON string of environment variables"
        required: true
        type: string
      enable-nancy:
        description: "Enable Nancy security scan"
        required: false
        type: boolean
        default: true
      enable-govulncheck:
        description: "Enable govulncheck security scan"
        required: false
        type: boolean
        default: true
      enable-gitleaks:
        description: "Enable Gitleaks security scan"
        required: false
        type: boolean
        default: true
      primary-runner:
        description: "Primary runner OS"
        required: true
        type: string
      go-primary-version:
        description: "Primary Go version"
        required: true
        type: string
      go-sum-file:
        description: "Path to go.sum file for dependency verification"
        required: true
        type: string
    secrets:
      github-token:
        description: "GitHub token for API access"
        required: true
      gitleaks-license:
        description: "Gitleaks license key"
        required: false
      ossi-username:
        description: "OSS Index username or email for Nancy authentication"
        required: false
      ossi-token:
        description: "OSS Index API token for Nancy authentication"
        required: false

# Security: Restrict default permissions (jobs must explicitly request what they need)
permissions: {}

jobs:
  # ----------------------------------------------------------------------------------
  # Ask Nancy (Dependency Checks)
  # ----------------------------------------------------------------------------------
  ask-nancy:
    name: 🛡️ Ask Nancy (Dependency Checks)
    runs-on: ${{ inputs.primary-runner }}
    if: ${{ inputs.enable-nancy }}
    permissions:
      contents: read
    steps:
      # --------------------------------------------------------------------
      # Checkout code (required for local actions)
      # --------------------------------------------------------------------
      - name: 📥 Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      # --------------------------------------------------------------------
      # Parse environment variables
      # --------------------------------------------------------------------
      - name: 🔧 Parse environment variables
        uses: ./.github/actions/parse-env
        with:
          env-json: ${{ inputs.env-json }}

      # --------------------------------------------------------------------
      # Setup Go with caching and version management
      # --------------------------------------------------------------------
      - name: 🏗️ Setup Go with Cache
        id: setup-ask-nancy
        uses: ./.github/actions/setup-go-with-cache
        with:
          go-version: ${{ inputs.go-primary-version }}
          matrix-os: ${{ inputs.primary-runner }}
          go-primary-version: ${{ inputs.go-primary-version }}
          go-secondary-version: ${{ inputs.go-primary-version }}
          go-sum-file: ${{ inputs.go-sum-file }}
          enable-multi-module: ${{ env.ENABLE_MULTI_MODULE_TESTING }}
          github-token: ${{ secrets.github-token }}

      # --------------------------------------------------------------------
      # Extract Go module directory from GO_SUM_FILE path
      # --------------------------------------------------------------------
      - name: 🔧 Extract Go module directory
        uses: ./.github/actions/extract-module-dir
        with:
          go-sum-file: ${{ inputs.go-sum-file }}

      # --------------------------------------------------------------------
      # Write the "go" list to file for Nancy
      # --------------------------------------------------------------------
      - name: 📝 Write go list
        run: |
          echo "📋 Generating module list for security scanning..."
          GO_MODULE_DIR="${{ env.GO_MODULE_DIR }}"

          if [ "$ENABLE_MULTI_MODULE_TESTING" == "true" ]; then
            echo "🔧 Multi-module enabled - running go list from repository root"
            echo "📦 go.work will discover all Go modules"
            go list -json -m all > go.list
          elif [ -n "$GO_MODULE_DIR" ]; then
            echo "🔧 Running go list from directory: $GO_MODULE_DIR"
            (cd "$GO_MODULE_DIR" && go list -json -m all > ../go.list)
          else
            echo "🔧 Running go list from repository root"
            go list -json -m all > go.list
          fi

          echo "✅ Module list generated successfully"

      # --------------------------------------------------------------------
      # Install Nancy
      # --------------------------------------------------------------------
      - name: 📥 Install Nancy
        run: |
          echo "📥 Installing nancy version ${{ env.NANCY_VERSION }}..."
          go install github.com/sonatype-nexus-community/nancy@${{ env.NANCY_VERSION }}
          echo "✅ Nancy installed successfully"

      # --------------------------------------------------------------------
      # Run Nancy to check for vulnerabilities
      # --------------------------------------------------------------------
      - name: 🔍 Ask Nancy
        id: run-nancy
        continue-on-error: true
        env:
          OSSI_USERNAME: ${{ secrets.ossi-username }}
          OSSI_TOKEN: ${{ secrets.ossi-token }}
        run: |
          echo "🔍 Running Nancy security scan..."
          set +e
          nancy sleuth --loud --exclude-vulnerability ${{ env.NANCY_EXCLUDES }} < go.list 2>&1 | tee nancy-output.log
          NANCY_EXIT_CODE=${PIPESTATUS[0]}
          set -e

          echo "nancy-exit-code=$NANCY_EXIT_CODE" >> $GITHUB_OUTPUT
          if [[ $NANCY_EXIT_CODE -eq 0 ]]; then
            echo "nancy-status=success" >> $GITHUB_OUTPUT
            echo "✅ Nancy scan completed - no vulnerabilities found"
          else
            echo "nancy-status=failure" >> $GITHUB_OUTPUT
            echo "❌ Nancy scan completed - vulnerabilities detected (exit code: $NANCY_EXIT_CODE)"
          fi

      # --------------------------------------------------------------------
      # Create GitHub Annotations for failures
      # --------------------------------------------------------------------
      - name: 📋 Create GitHub Annotations
        if: always() && steps.run-nancy.outputs.nancy-status == 'failure'
        run: |
          echo "::error title=Nancy Security Scan Failed::Vulnerabilities detected in Go dependencies - see job summary for details"

      # --------------------------------------------------------------------
      # Summary of Nancy results
      # --------------------------------------------------------------------
      - name: 📊 Job Summary
        if: always()
        run: |
          NANCY_STATUS="${{ steps.run-nancy.outputs.nancy-status }}"

          echo "## 🛡️ Nancy Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Scan Details | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Tool** | Nancy Sleuth |" >> $GITHUB_STEP_SUMMARY
          echo "| **Mode** | Loud mode with exclusions |" >> $GITHUB_STEP_SUMMARY
          echo "| **Scope** | All Go modules |" >> $GITHUB_STEP_SUMMARY
          echo "| **Version** | ${{ env.NANCY_VERSION }} |" >> $GITHUB_STEP_SUMMARY

          if [[ "$NANCY_STATUS" == "success" ]]; then
            echo "| **Result** | ✅ No vulnerabilities found |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| **Result** | ❌ Vulnerabilities detected |" >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 🚫 Excluded Vulnerabilities" >> $GITHUB_STEP_SUMMARY
          echo "The following vulnerabilities were excluded from the scan:" >> $GITHUB_STEP_SUMMARY
          echo "${{ env.NANCY_EXCLUDES }}" >> $GITHUB_STEP_SUMMARY

          # Show failure details if applicable
          if [[ "$NANCY_STATUS" != "success" ]] && [[ -f nancy-output.log ]]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🚨 Vulnerability Details" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "<details>" >> $GITHUB_STEP_SUMMARY
            echo "<summary>Click to expand full scan output</summary>" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            head -200 nancy-output.log >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "</details>" >> $GITHUB_STEP_SUMMARY
          fi

      # --------------------------------------------------------------------
      # Upload Nancy scan results
      # --------------------------------------------------------------------
      - name: 📤 Upload Nancy scan results
        if: always()
        uses: ./.github/actions/upload-artifact-resilient
        with:
          artifact-name: nancy-scan-results
          artifact-path: nancy-output.log
          retention-days: "7"
          if-no-files-found: ignore

      # --------------------------------------------------------------------
      # Collect cache statistics
      # --------------------------------------------------------------------
      - name: 📊 Collect cache statistics
        uses: ./.github/actions/collect-cache-stats
        with:
          workflow-name: nancy-security
          job-name: nancy-security
          os: ${{ inputs.primary-runner }}
          go-version: ${{ inputs.go-primary-version }}
          cache-prefix: cache-stats
          gomod-cache-hit: ${{ steps.setup-ask-nancy.outputs.module-cache-hit }}
          gobuild-cache-hit: ${{ steps.setup-ask-nancy.outputs.build-cache-hit }}

      # --------------------------------------------------------------------
      # Upload infrastructure cache statistics
      # --------------------------------------------------------------------
      - name: 📤 Upload infrastructure cache statistics
        uses: ./.github/actions/upload-statistics
        with:
          artifact-name: cache-stats-security-nancy
          artifact-path: cache-stats-nancy-security.json

      # --------------------------------------------------------------------
      # Fail job if vulnerabilities found
      # --------------------------------------------------------------------
      - name: 🚨 Fail job if vulnerabilities found
        if: always() && steps.run-nancy.outputs.nancy-status == 'failure'
        run: |
          echo "❌ Nancy detected vulnerabilities in dependencies"
          exit 1

  # ----------------------------------------------------------------------------------
  # Govulncheck (Vulnerability Checks)
  # ----------------------------------------------------------------------------------
  govulncheck:
    name: 🔐 Run govulncheck (Vulnerability Scan)
    runs-on: ${{ inputs.primary-runner }}
    if: ${{ inputs.enable-govulncheck }}
    permissions:
      contents: read
    steps:
      # --------------------------------------------------------------------
      # Checkout code (required for local actions)
      # --------------------------------------------------------------------
      - name: 📥 Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      # --------------------------------------------------------------------
      # Parse environment variables
      # --------------------------------------------------------------------
      - name: 🔧 Parse environment variables
        uses: ./.github/actions/parse-env
        with:
          env-json: ${{ inputs.env-json }}

      # --------------------------------------------------------------------
      # Setup Go with caching and version management
      # Uses GOVULNCHECK_GO_VERSION if set, otherwise falls back to primary version
      # This allows govulncheck to use a newer Go version for accurate stdlib vulnerability detection
      # --------------------------------------------------------------------
      - name: 🏗️ Setup Go with Cache
        id: setup-govulncheck
        uses: ./.github/actions/setup-go-with-cache
        with:
          go-version: ${{ env.GOVULNCHECK_GO_VERSION || inputs.go-primary-version }}
          matrix-os: ${{ inputs.primary-runner }}
          go-primary-version: ${{ inputs.go-primary-version }}
          go-secondary-version: ${{ inputs.go-primary-version }}
          go-sum-file: ${{ inputs.go-sum-file }}
          enable-multi-module: ${{ env.ENABLE_MULTI_MODULE_TESTING }}
          github-token: ${{ secrets.github-token }}

      # --------------------------------------------------------------------
      # Extract Go module directory from GO_SUM_FILE path
      # --------------------------------------------------------------------
      - name: 🔧 Extract Go module directory
        uses: ./.github/actions/extract-module-dir
        with:
          go-sum-file: ${{ inputs.go-sum-file }}

      # --------------------------------------------------------------------
      # Setup MAGE-X (required for magex deps:audit command)
      # --------------------------------------------------------------------
      - name: 🔧 Setup MAGE-X
        uses: ./.github/actions/setup-magex
        with:
          magex-version: ${{ env.MAGE_X_VERSION }}
          runner-os: ${{ inputs.primary-runner }}
          use-local: ${{ env.MAGE_X_USE_LOCAL }}

      # --------------------------------------------------------------------
      # Restore (and later save) a compact cache for the govulncheck binary
      # and its vulnerability DB files.
      # --------------------------------------------------------------------
      - name: 💾 Restore govulncheck binary cache
        id: govuln-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/govulncheck-bin
          key: ${{ inputs.primary-runner }}-govulncheck-${{ env.GOVULNCHECK_VERSION }}-go${{ env.GOVULNCHECK_GO_VERSION }}

      - name: 🛠️ Make cached govulncheck usable
        run: |
          set -euo pipefail
          BIN_DIR="$HOME/.cache/govulncheck-bin"
          GOVULN_BIN="$BIN_DIR/govulncheck"
          # If we restored a cache, copy/link it into GOPATH/bin so the binary works.
          if [[ -f "$GOVULN_BIN" ]]; then
            echo "✅ Using cached govulncheck binary"
            mkdir -p "$(go env GOPATH)/bin"
            cp "$GOVULN_BIN" "$(go env GOPATH)/bin/"
          fi
          # Make sure the binary location is on PATH for *all* subsequent steps.
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      # --------------------------------------------------------------------
      # Install govulncheck *only* when the cache was empty.
      # --------------------------------------------------------------------
      - name: 📥 Install govulncheck (cache miss)
        if: steps.govuln-cache.outputs.cache-hit != 'true'
        run: |
          echo "⬇️ Cache miss – installing govulncheck..."
          echo "🔧 Installing govulncheck version ${{ env.GOVULNCHECK_VERSION }}..."
          go install golang.org/x/vuln/cmd/govulncheck@${{ env.GOVULNCHECK_VERSION }}
          # Copy the freshly built binary back into the cache directory
          mkdir -p ~/.cache/govulncheck-bin
          cp "$(go env GOPATH)/bin/govulncheck" ~/.cache/govulncheck-bin/
          echo "✅ govulncheck installed and stored in cache"

      # --------------------------------------------------------------------
      # Run govulncheck
      # --------------------------------------------------------------------
      - name: 🔐 Run govulncheck
        id: run-govulncheck
        continue-on-error: true
        run: |
          echo "🔍 Running vulnerability analysis..."
          GO_MODULE_DIR="${{ env.GO_MODULE_DIR }}"

          # Show CVE exclusions if configured
          if [ -n "${MAGE_X_CVE_EXCLUDES:-}" ]; then
            echo "🚫 CVE exclusions configured: $MAGE_X_CVE_EXCLUDES"
          fi

          set +e
          if [ "$ENABLE_MULTI_MODULE_TESTING" == "true" ]; then
            echo "🔧 Multi-module enabled - running magex deps:audit from repository root"
            echo "📦 magex will discover all Go modules"
            magex deps:audit 2>&1 | tee govulncheck-output.log
            GOVULN_EXIT_CODE=${PIPESTATUS[0]}
          elif [ -n "$GO_MODULE_DIR" ]; then
            echo "🔧 Running magex deps:audit from directory: $GO_MODULE_DIR"
            (cd "$GO_MODULE_DIR" && magex deps:audit 2>&1 | tee ../govulncheck-output.log)
            GOVULN_EXIT_CODE=${PIPESTATUS[0]}
          else
            echo "🔧 Running magex deps:audit from repository root"
            magex deps:audit 2>&1 | tee govulncheck-output.log
            GOVULN_EXIT_CODE=${PIPESTATUS[0]}
          fi
          set -e

          echo "govuln-exit-code=$GOVULN_EXIT_CODE" >> $GITHUB_OUTPUT
          if [[ $GOVULN_EXIT_CODE -eq 0 ]]; then
            echo "govuln-status=success" >> $GITHUB_OUTPUT
            echo "✅ Vulnerability scan completed - no vulnerabilities found"
          else
            echo "govuln-status=failure" >> $GITHUB_OUTPUT
            echo "❌ Vulnerability scan completed - vulnerabilities detected (exit code: $GOVULN_EXIT_CODE)"
          fi

      # --------------------------------------------------------------------
      # Create GitHub Annotations for failures
      # --------------------------------------------------------------------
      - name: 📋 Create GitHub Annotations
        if: always() && steps.run-govulncheck.outputs.govuln-status == 'failure'
        run: |
          echo "::error title=Govulncheck Failed::Go vulnerabilities detected - see job summary for details"

      # --------------------------------------------------------------------
      # Summary of govulncheck results
      # --------------------------------------------------------------------
      - name: 📊 Job Summary
        if: always()
        run: |
          GOVULN_STATUS="${{ steps.run-govulncheck.outputs.govuln-status }}"

          echo "## 🔐 govulncheck Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Analysis Details | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Tool** | govulncheck (Official Go Security Tool) |" >> $GITHUB_STEP_SUMMARY
          echo "| **Installation** | $( [[ '${{ steps.govuln-cache.outputs.cache-hit }}' == 'true' ]] && echo '💾 From cache' || echo '📥 Fresh install' ) |" >> $GITHUB_STEP_SUMMARY
          echo "| **Scope** | All packages in module |" >> $GITHUB_STEP_SUMMARY

          if [[ "$GOVULN_STATUS" == "success" ]]; then
            echo "| **Result** | ✅ No vulnerabilities detected |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| **Result** | ❌ Vulnerabilities detected |" >> $GITHUB_STEP_SUMMARY
          fi

          echo "| **Version** | ${{ env.GOVULNCHECK_VERSION }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # Show excluded vulnerabilities if configured
          if [ -n "${MAGE_X_CVE_EXCLUDES:-}" ]; then
            echo "### 🚫 Excluded Vulnerabilities" >> $GITHUB_STEP_SUMMARY
            echo "The following vulnerabilities were excluded from the scan:" >> $GITHUB_STEP_SUMMARY
            echo "\`${MAGE_X_CVE_EXCLUDES}\`" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
          fi

          # Show failure details if applicable
          if [[ "$GOVULN_STATUS" != "success" ]] && [[ -f govulncheck-output.log ]]; then
            echo "### 🚨 Vulnerability Details" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "<details>" >> $GITHUB_STEP_SUMMARY
            echo "<summary>Click to expand full scan output</summary>" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            head -200 govulncheck-output.log >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "</details>" >> $GITHUB_STEP_SUMMARY
          else
            echo "🎯 **Analysis completed successfully with no security issues found.**" >> $GITHUB_STEP_SUMMARY
          fi

      # --------------------------------------------------------------------
      # Upload govulncheck results
      # --------------------------------------------------------------------
      - name: 📤 Upload govulncheck results
        if: always()
        uses: ./.github/actions/upload-artifact-resilient
        with:
          artifact-name: govulncheck-scan-results
          artifact-path: govulncheck-output.log
          retention-days: "7"
          if-no-files-found: ignore

      # --------------------------------------------------------------------
      # Collect cache statistics
      # --------------------------------------------------------------------
      - name: 📊 Collect cache statistics
        uses: ./.github/actions/collect-cache-stats
        with:
          workflow-name: govulncheck-security
          job-name: govulncheck-security
          os: ${{ inputs.primary-runner }}
          go-version: ${{ inputs.go-primary-version }}
          cache-prefix: cache-stats
          gomod-cache-hit: ${{ steps.setup-govulncheck.outputs.module-cache-hit }}
          gobuild-cache-hit: ${{ steps.setup-govulncheck.outputs.build-cache-hit }}

      # --------------------------------------------------------------------
      # Upload infrastructure cache statistics
      # --------------------------------------------------------------------
      - name: 📤 Upload infrastructure cache statistics
        uses: ./.github/actions/upload-statistics
        with:
          artifact-name: cache-stats-security-govulncheck
          artifact-path: cache-stats-govulncheck-security.json

      # --------------------------------------------------------------------
      # Fail job if vulnerabilities found
      # --------------------------------------------------------------------
      - name: 🚨 Fail job if vulnerabilities found
        if: always() && steps.run-govulncheck.outputs.govuln-status == 'failure'
        run: |
          echo "❌ Govulncheck detected vulnerabilities in dependencies"
          exit 1

  # ----------------------------------------------------------------------------------
  # Gitleaks (Secret Scanning)
  # ----------------------------------------------------------------------------------
  gitleaks:
    name: 🕵️ Run Gitleaks (Secret Scan)
    runs-on: ${{ inputs.primary-runner }}
    if: ${{ inputs.enable-gitleaks }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      # --------------------------------------------------------------------
      # Checkout code (required for local actions)
      # --------------------------------------------------------------------
      - name: 📥 Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0 # Fetch all history so Gitleaks can scan commits

      # --------------------------------------------------------------------
      # Parse environment variables
      # --------------------------------------------------------------------
      - name: 🔧 Parse environment variables
        uses: ./.github/actions/parse-env
        with:
          env-json: ${{ inputs.env-json }}

      # --------------------------------------------------------------------
      # Check repository security conditions
      # --------------------------------------------------------------------
      - name: 🔍 Check repository security conditions
        id: repo-check
        env:
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name || '' }}
        run: |
          echo "🔍 Checking repository security conditions..."
          echo "Event Name: $GITHUB_EVENT_NAME"
          echo "Actor: $GITHUB_ACTOR"
          echo "Repository: $GITHUB_REPOSITORY"
          echo "Head Ref: $GITHUB_HEAD_REF"

          # For workflow_call, we typically trust the calling workflow from the same repo
          # For pull_request events, check if head repo matches base repo
          if [[ "$GITHUB_EVENT_NAME" == "workflow_call" ]]; then
            echo "✅ Workflow call from same repository - security scans allowed"
            echo "is_same_repo=true" >> $GITHUB_OUTPUT
          elif [[ "$PR_HEAD_REPO" == "$GITHUB_REPOSITORY" ]] || [[ -z "$PR_HEAD_REPO" ]]; then
            echo "✅ Same repository or push event - security scans allowed"
            echo "is_same_repo=true" >> $GITHUB_OUTPUT
          else
            echo "⚠️  Fork detected - skipping secret-sensitive scans for security"
            echo "PR Head Repo: $PR_HEAD_REPO"
            echo "is_same_repo=false" >> $GITHUB_OUTPUT
          fi

      - name: 🔍 Run gitleaks scan
        id: run-gitleaks
        if: steps.repo-check.outputs.is_same_repo == 'true'
        continue-on-error: true
        # NOTE: gitleaks/gitleaks-action@v2.3.9 is the latest release and still uses Node.js 20.
        # This will trigger a "Node.js 20 actions are deprecated" warning until the gitleaks
        # maintainers release a new version with Node.js 24 support. Expected and harmless for now.
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GITLEAKS_LICENSE: ${{ secrets.gitleaks-license }}
          GITLEAKS_NOTIFY_USER_LIST: ${{ env.GITLEAKS_NOTIFY_USER_LIST }}
          GITLEAKS_ENABLE_COMMENTS: "true"
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "true"
          GITLEAKS_ENABLE_SUMMARY: "true"
          GITLEAKS_VERSION: ${{ env.GITLEAKS_VERSION }}
          GITLEAKS_CONFIG: ${{ env.GITLEAKS_CONFIG_FILE }}

      # --------------------------------------------------------------------
      # Create GitHub Annotations for failures
      # --------------------------------------------------------------------
      - name: 📋 Create GitHub Annotations
        if: always() && steps.repo-check.outputs.is_same_repo == 'true' && steps.run-gitleaks.outcome == 'failure'
        run: |
          echo "::error title=Gitleaks Secret Scan Failed::Secrets detected in repository - see job summary for details"

      - name: 📊 Job Summary
        if: always() && steps.repo-check.outputs.is_same_repo == 'true'
        run: |
          GITLEAKS_OUTCOME="${{ steps.run-gitleaks.outcome }}"

          echo "## 🕵️ Gitleaks Secret Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Scan Details | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Tool** | Gitleaks |" >> $GITHUB_STEP_SUMMARY
          echo "| **Version** | ${{ env.GITLEAKS_VERSION }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Scope** | All commits and files |" >> $GITHUB_STEP_SUMMARY
          echo "| **Config** | $([ -n "${{ env.GITLEAKS_CONFIG_FILE }}" ] && echo "Custom: \`${{ env.GITLEAKS_CONFIG_FILE }}\`" || echo "Default (built-in rules)") |" >> $GITHUB_STEP_SUMMARY

          if [[ "$GITLEAKS_OUTCOME" == "success" ]]; then
            echo "| **Result** | ✅ No secrets detected |" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "🎯 **Secret scan completed successfully.**" >> $GITHUB_STEP_SUMMARY
          else
            echo "| **Result** | ❌ Secrets detected |" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🚨 Action Required" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "Gitleaks has detected secrets in the repository. Please review the scan output and remove any exposed secrets." >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Note:** The detailed findings are available in the Gitleaks-generated summary above this section." >> $GITHUB_STEP_SUMMARY
          fi

      - name: 📊 Fork Security Notice
        if: steps.repo-check.outputs.is_same_repo == 'false'
        run: |
          echo "## 🕵️ Gitleaks Secret Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| 🔒 Security Details | ⚠️  Status |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Tool** | Gitleaks |" >> $GITHUB_STEP_SUMMARY
          echo "| **Fork Detected** | ${{ github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name || 'N/A (not a PR event)' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Base Repository** | ${{ github.repository }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Result** | ⚠️  Skipped for security (fork cannot access secrets) |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "🔒 **Secret scanning was skipped because this PR comes from a fork. This is a security feature to prevent secret exposure.**" >> $GITHUB_STEP_SUMMARY

      # --------------------------------------------------------------------
      # Fail job if secrets found
      # --------------------------------------------------------------------
      - name: 🚨 Fail job if secrets found
        if: always() && steps.repo-check.outputs.is_same_repo == 'true' && steps.run-gitleaks.outcome == 'failure'
        run: |
          echo "❌ Gitleaks detected secrets in the repository"
          exit 1