From cf1da8a2faaca9ce4621493cf6fb596c5349b90e Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:56:13 +0200
Subject: [PATCH] fix(security): add standalone secret-scan job to CI

Had a real dependency-audit gate (npm audit --audit-level=high) but no
secret scan. trufflehog's Action is Docker-based and cannot run on this
repo's existing windows-latest runner (needed for the Windows desktop
app's own browser/quality tests), so this adds it as a separate,
parallel ubuntu-latest job rather than inserting it into the Windows
job where it would break CI - the last gap for this repo to count as
fully-authored.
---
 .gitea/workflows/quality.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index d07bac2..56e5f4b 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -6,6 +6,16 @@ on:
   pull_request:
 
 jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
+
   quality:
     runs-on: windows-latest
     steps: