From 0e2bb716a55144c9ba1ad5290903e49460706eef Mon Sep 17 00:00:00 2001 From: schapron Date: Tue, 29 Sep 2026 17:06:39 +0200 Subject: [PATCH] fix(secu): restore gitleaks scan on pull requests Since #70 scoped the gitleaks job token to `contents: read`, every pull_request run fails with a 403 before scanning: gitleaks-action lists the PR commits (GET /repos/{owner}/{repo}/pulls/{n}/commits) to build the scan range, and that endpoint requires `pull-requests: read`. Grant that read scope alongside `contents: read`. No write scope is needed: PR comments, artifact upload and job summary stay disabled. Push runs are unaffected, they take the commit range from the event payload. Refs: SECU-1231 Assisted-by: Claude Code (claude-opus-5-5) Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/gitleaks-analysis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/gitleaks-analysis.yml b/.github/workflows/gitleaks-analysis.yml index 2b21684b..60291963 100644 --- a/.github/workflows/gitleaks-analysis.yml +++ b/.github/workflows/gitleaks-analysis.yml @@ -9,6 +9,7 @@ jobs: runs-on: ${{ github.repository_visibility != 'public' && (github.repository_owner == 'centreon' && 'centreon-security' || github.repository_owner == 'quanta-computing' && 'quanta-security') || 'ubuntu-24.04' }} permissions: contents: read + pull-requests: read steps: - name: Checkout Repository