secrets-scan.yaml

# GitHub Actions workflow that calls the brightwheel appsec-tooling reusable workflow for secrets
# scanning on protected branches.
#
# DEPENDENCIES:
#
#  * Organization-level Variable (Settings → Secrets and variables → Actions → Variables):
#    - APPSEC_SCANNER_PULL_ROLE_ARN: AWS IAM role ARN for ECR scanner image access via OIDC

name: Secrets Scan

on:
  # Automatic scanning on every push to PR branches
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches:
      - master
  # Manual trigger
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to scan (optional)"
        required: false
      ref:
        description: "Branch/ref to scan (optional, defaults to current)"
        required: false

jobs:
  scan:
    if: ${{ !github.event.pull_request.draft || github.event_name == 'workflow_dispatch' }}
    uses: brightwheel/appsec-tooling/.github/workflows/reusable-secrets-scan.yaml@main
    secrets: inherit