From 71089746e26e736b5c3f1e848a409a2bfc8ce141 Mon Sep 17 00:00:00 2001 From: arunSunnyKVS Date: Fri, 3 Jul 2026 12:15:37 +0000 Subject: [PATCH] fix: revert gitleaks trigger from pull_request_target to pull_request gitleaks/gitleaks-action@v2 does not support the pull_request_target event, causing the secret scan job to fail with: "ERROR: The [pull_request_target] event is not yet supported" Revert to pull_request which is both supported by gitleaks and the safer trigger for scanning untrusted fork code. First-time fork contributors will need a maintainer to approve the workflow run, which is GitHub's intended behavior for external PRs. Also removes the explicit ref override since pull_request already checks out the correct merge commit by default. Co-authored-by: Cursor --- .github/workflows/secret-scan.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 5554d3c..6c55822 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -1,7 +1,7 @@ name: Secret Scan on: - pull_request_target: + pull_request: branches: [master, main] push: branches: [master, main] @@ -16,7 +16,6 @@ jobs: steps: - uses: actions/checkout@v4 with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 persist-credentials: false - uses: gitleaks/gitleaks-action@v2