From 736114bbca59622256a17509f22bcb120809e2c5 Mon Sep 17 00:00:00 2001 From: arybach <54408501+arybach@users.noreply.github.com> Date: Fri, 25 Sep 2026 12:43:34 -0400 Subject: [PATCH] chore(ci): pin gitleaks version in secret-scan (de-flake transient false failure) Matches the fix already merged on agentic-os. The unauthenticated api.github.com releases/latest call rate-limits on shared Actions runners, leaving an empty version and a broken download URL that fails CI under set -e -- a transient FALSE failure, not a committed secret. Pinning removes the API call; scan command unchanged. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scan.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 755def1..06597b6 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -23,8 +23,10 @@ jobs: - name: Run gitleaks (redacted) run: | set -euo pipefail - ver="$(curl -sSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest \ - | grep -oP '"tag_name": *"v\K[^"]+')" - curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${ver}/gitleaks_${ver}_linux_x64.tar.gz" \ + # Pinned version — avoids the unauthenticated GitHub API 'releases/latest' call, which + # rate-limits (403) on shared Actions IPs and, under 'set -e', left an empty version and a + # broken download URL that failed CI transiently. Bump deliberately. + ver="8.30.1" + curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${ver}/gitleaks_${ver}_linux_x64.tar.gz" \ | tar -xz gitleaks ./gitleaks detect --source . --redact --no-banner --exit-code 1