SatoshiQaziMuhammed d7585a346c ci(security): scan new commits on push/PR and the current tree weekly (#73) ...

* ci(security): scan new commits on push/PR and the current tree weekly

`base: main` made every push to main rescan the whole history. Nova's own
Infura keys, removed from the files in #72 but still in history and live,
kept Secret Scan red on every push since at least 2026-09-21, so a new leak
would have read as the same old red.

- push and pull_request: no `base`, so the action scans only the commits the
  event brings (before..after, or the PR's base..head)
- schedule: scan a `git archive HEAD` copy of today's tree
- pin the action to v3.99.2 by commit and the image to 3.99.2 (was @main and
  latest)

* ci(security): exempt the TruffleHog action from the AGPL licence denial

Pinning the action made dependency review evaluate it for the first time.
It runs unmodified in CI and is not linked into or shipped with anything.

2026-10-18 06:28:53 +04:00

..

code-quality.yml

fix(pezkuwi): finish the Asset Hub cleanup and guard it against coming back (#69)

2026-08-11 05:20:49 -07:00

promote-to-live.yml

ci: run the gate before the deploy, not after it (#70)

2026-08-11 05:39:28 -07:00

security.yml

ci(security): scan new commits on push/PR and the current tree weekly (#73)

2026-10-18 06:28:53 +04:00

sync-nova-base.yml

ci: run the gate before the deploy, not after it (#70)

2026-08-11 05:39:28 -07:00