fix(web): guard team invites without instance scope #1303
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| # Catch anything that slipped in through a direct push or rebase. | |
| - cron: "17 5 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| name: gitleaks | |
| runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'self-hosted' }} | |
| steps: | |
| - name: Reset workspace ownership | |
| run: | | |
| docker run --rm -v "$GITHUB_WORKSPACE:/ws" alpine \ | |
| chown -R $(id -u):$(id -g) /ws 2>/dev/null || true | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C "$HOME" gitleaks | |
| echo "$HOME" >> "$GITHUB_PATH" | |
| - name: Run gitleaks | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| # Scan only commits introduced by this PR. | |
| gitleaks detect \ | |
| --redact \ | |
| --report-format sarif \ | |
| --report-path gitleaks.sarif \ | |
| --log-opts "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" | |
| else | |
| # Scan everything on push / schedule. | |
| gitleaks detect \ | |
| --redact \ | |
| --report-format sarif \ | |
| --report-path gitleaks.sarif | |
| fi | |
| - name: Clean up runner disk | |
| if: always() | |
| run: | | |
| set +e | |
| docker run --rm -v "$GITHUB_WORKSPACE:/ws" alpine \ | |
| chown -R "$(id -u):$(id -g)" /ws 2>/dev/null || true | |
| find "$GITHUB_WORKSPACE" -mindepth 1 -delete 2>/dev/null || true | |
| rm -rf /tmp/digests 2>/dev/null || true | |
| docker buildx prune -f --filter "until=1h" 2>/dev/null || true | |
| docker system prune -f --filter "until=1h" 2>/dev/null || true | |
| exit 0 |