From 9d8913c13449fd8e52d712312c6253a9e3949ebb Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 23:56:33 +0200
Subject: [PATCH] ci: use nested-runner-safe secret scan

---
 .gitea/workflows/release-gates.yml | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml
index 66c3fba3..84239e59 100644
--- a/.gitea/workflows/release-gates.yml
+++ b/.gitea/workflows/release-gates.yml
@@ -23,11 +23,8 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
-      - name: Secret scan
-        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b
-        with:
-          path: ./
-          extra_args: --only-verified
+      - name: Verified secret scan
+        run: bash scripts/scan_secrets.sh
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.11"