From a9f48d688067f37bbc33fd970e9d727d52afd259 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:54:44 +0200
Subject: [PATCH] fix(security): add secret-scan step to backend CI job

Backend job had static checks (ruff/mypy) and a dependency-vulnerability
gate but no secret scan; frontend had a dependency audit but no secret
scan either. Adds trufflehog once, on the backend job's full checkout,
covering the whole repository - the last gap for this repo to count as
fully-authored.
---
 .gitea/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7126b19..7c4e10c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -10,6 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
       - name: Backend tests in isolated PostgreSQL stack
         run: sh scripts/run-isolated-tests.sh
       - name: Backend static checks