build(deps): Bump qs from 6.15.1 to 6.15.2 in /mcp (#7) #8

	name: Secret Scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: secrets-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	gitleaks:
	name: gitleaks
	runs-on: ubuntu-latest
	steps:
	- uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	egress-policy: audit
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	fetch-depth: 0 # scan full history
	persist-credentials: false
	# The gitleaks GitHub Action requires a paid license for org accounts, but
	# the gitleaks binary itself is free (MIT). Run it directly.
	- name: Install gitleaks
	env:
	GITLEAKS_VERSION: "8.30.1"
	run: \|
	curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
	\| tar -xz -C /usr/local/bin gitleaks
	gitleaks version
	- name: Scan repository
	# --config points at the repo allowlist (.gitleaks.toml), which extends
	# the default ruleset and excludes the redaction unit-test fixtures that
	# intentionally embed fake secret-shaped strings.
	run: gitleaks dir . --config .gitleaks.toml --redact --verbose --exit-code 1

Navigation Menu