From bc145c8dcd44726807b4008388bb55effe002ada Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Fri, 6 Nov 2026 16:43:28 -0600
Subject: [PATCH] fix(container): secret-scan the current tree before the
 build, verbose and redacted

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/container.yaml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/container.yaml b/.gitea/workflows/container.yaml
index e417122..e53bb71 100644
--- a/.gitea/workflows/container.yaml
+++ b/.gitea/workflows/container.yaml
@@ -113,10 +113,6 @@ jobs:
           </settings>
           EOF
 
-      - name: Test and build
-        shell: bash
-        run: ${{ inputs.prebuild }}
-
       - name: Install scanners
         shell: bash
         run: |
@@ -130,9 +126,14 @@ jobs:
           echo /tmp/tools >> "$GITHUB_PATH"
 
       - name: Secret scan
+        # Current source tree before the build (history findings belong to rotation, not to every release).
         if: env.PUBLISH == 'true'
         shell: bash
-        run: gitleaks detect --source . --redact --no-banner
+        run: gitleaks detect --no-git --source . --redact --no-banner --verbose
+
+      - name: Test and build
+        shell: bash
+        run: ${{ inputs.prebuild }}
 
       - name: Build and scan images
         shell: bash