gitguardian.yml

name: GitGuardian Scan

on:
  push:
    branches:
      - main
      - canary
      - experimental
  pull_request:
    branches:
      - "**"

jobs:
  scanning:
    name: GitGuardian scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0 # fetch all history so multiple commits can be scanned
          persist-credentials: false

      - name: GitGuardian scan
        uses: GitGuardian/ggshield/actions/secret@v1.39.0
        with:
          args:
            "--exclude pnpm-lock.yaml --exclude tools/config/verdaccio.yml
            --exclude nx.json"
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}