added gitleaks workflow

[0xcucumbersalad]

added gitleaks workflow

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	storefront-tanstack	cc1367a	Commit Preview URL Branch Preview URL	Aug 14 2026, 05:59 AM

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/sast.yml">

<violation number="1" location=".github/workflows/sast.yml:27">
P3: gitleaks-action uses GITHUB_TOKEN both to read the PR commit list and to post PR review comments annotating the findings. The job only grants `pull-requests: read`, so the inline-commenting feature will fail (403) and leaks will surface only in the run logs/check, not on the PR. Add `pull-requests: write` if you want gitleaks to annotate findings on PRs; the read permission alone is sufficient only to run the scan and fail the check.</violation>

<violation number="2" location=".github/workflows/sast.yml:40">
P2: This is an org-owned repo (deco-sites), and the comment notes gitleaks-action requires a license key for org-owned repos. If the GITLEAKS_LICENSE secret is not configured before this merges, the job hard-fails on every pull_request and main push, blocking all CI. Confirm the secret is set at the org/repo level before merging (or make the license check explicit rather than relying on an unset secret).</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This is an org-owned repo (deco-sites), and the comment notes gitleaks-action requires a license key for org-owned repos. If the GITLEAKS_LICENSE secret is not configured before this merges, the job hard-fails on every pull_request and main push, blocking all CI. Confirm the secret is set at the org/repo level before merging (or make the license check explicit rather than relying on an unset secret).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/sast.yml, line 40:

<comment>This is an org-owned repo (deco-sites), and the comment notes gitleaks-action requires a license key for org-owned repos. If the GITLEAKS_LICENSE secret is not configured before this merges, the job hard-fails on every pull_request and main push, blocking all CI. Confirm the secret is set at the org/repo level before merging (or make the license check explicit rather than relying on an unset secret).</comment>

<file context>
@@ -0,0 +1,40 @@
+      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
</file context>

[cubic-dev-ai]

P3: gitleaks-action uses GITHUB_TOKEN both to read the PR commit list and to post PR review comments annotating the findings. The job only grants pull-requests: read, so the inline-commenting feature will fail (403) and leaks will surface only in the run logs/check, not on the PR. Add pull-requests: write if you want gitleaks to annotate findings on PRs; the read permission alone is sufficient only to run the scan and fail the check.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/sast.yml, line 27:

<comment>gitleaks-action uses GITHUB_TOKEN both to read the PR commit list and to post PR review comments annotating the findings. The job only grants `pull-requests: read`, so the inline-commenting feature will fail (403) and leaks will surface only in the run logs/check, not on the PR. Add `pull-requests: write` if you want gitleaks to annotate findings on PRs; the read permission alone is sufficient only to run the scan and fail the check.</comment>

<file context>
@@ -0,0 +1,40 @@
+      # On pull_request the action calls GET /repos/{o}/{r}/pulls/{n}/commits
+      # to scan only the PR range. Without this it 403s with
+      # "Resource not accessible by integration".
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
</file context>