From d1a573aaac733bd11738c8df89c8621c495e94bf Mon Sep 17 00:00:00 2001
From: Lahfir <70215676+lahfir@users.noreply.github.com>
Date: Sun, 26 Jul 2026 02:36:29 -0600
Subject: [PATCH] ci: scan git history for secrets, not just the checked-out
 tree

gitleaks dir only inspects the final tree, so a value added in one commit
and removed in a later one passes the scan while staying reachable in the
branch's history. Switch to git mode and fetch full history so the walk
has commits to scan; a shallow clone would silently degrade it back to a
tree scan.

Verified: a secret added then removed across two commits is invisible to
dir mode and caught by git mode. A full scan of the existing 454 commits
reports no leaks, so history mode is clean to adopt.
---
 .github/workflows/supply-chain.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index e85d1af3..acd441e3 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -23,6 +23,11 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Full history so the secret scan below can walk commits, not just
+          # the final tree. A shallow clone would silently reduce it to a
+          # working-tree scan.
+          fetch-depth: 0
 
       - name: Check release metadata consistency
         run: scripts/check-release-consistency.sh
@@ -52,7 +57,10 @@ jobs:
             "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
           echo "${GITLEAKS_SHA256}  ${archive}" | sha256sum --check --status
           tar -xzf "$archive" gitleaks
-          ./gitleaks dir . --config .gitleaks.toml --redact --no-banner --exit-code 1
+          # Scan commit history, not just the checked-out tree: a value added
+          # in one commit and removed in a later one stays reachable in branch
+          # history, and a tree-only scan would pass it.
+          ./gitleaks git . --config .gitleaks.toml --redact --no-banner --exit-code 1
 
       - name: Workflow security audit
         uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7