ci(security): scan only the checked-out history in the Gitleaks job

[lusoris]

Summary

On 2026-09-29, #1628 failed its Gitleaks check on build-config.env:218 of commit a74842e16. #1628 does not contain that commit. The commit was a pre-rebase version of fix/release-oneapi-image-runtime (#1629), and a force-push had already replaced it. The finding itself was a generic-api-key false positive on an apt signing-key fingerprint.

The job checks out with fetch-depth: 0, which fetches every branch, and runs gitleaks detect without --log-opts. In that case gitleaks runs git log --full-history --all, so every pull request scanned every branch in the repository. One branch's finding therefore failed all the others, including findings in commits that had already been replaced.

This PR passes --log-opts="--full-history HEAD". On a pull request, HEAD is the merge commit, so the scan covers master's history plus the PR's own commits. On pushes to master and on the schedule, it covers master. A new self-test step pins the option.

Type

• build / ci — tooling / infra

Checklist

• Commits follow Conventional Commits (the commit-msg hook enforces this).
• make format && make lint is green locally. Not run in full: one workflow step and one Python test changed; actionlint and the test pass.
• Unit tests pass: python3 scripts/ci/run_meson_test.py -- -C build. Not applicable: no native code changed.

Bug-status hygiene (ADR-0165)

• T-CI-GITLEAKS-SCANS-ALL-BRANCHES-2026-09-29 added to Recently closed.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: trivial scan-scope fix.
• Decision matrix — no alternatives: only-one-way fix. Scanning base..head instead would skip master's history on pull requests, and dropping fetch-depth: 0 would break the history scan.
• AGENTS.md invariant note — no rebase-sensitive invariants; the self-test enforces the option.
• Reproducer / smoke-test command — see below.
• CHANGELOG fragment — changelog.d/fixed/gitleaks-scan-checked-out-history.md.
• Rebase note — no rebase impact: fork-only workflow.

no docs needed: CI-internal scan scope with no user-discoverable surface.

Reproducer

python3 -B scripts/ci/tests/test_gitleaks_scan_scope.py          # 5 tests OK
docker run --rm -v "$PWD:/src:ro" --entrypoint sh zricethezav/gitleaks:v8.24.3 -c \
  'git config --global --add safe.directory "*"; gitleaks detect --source /src \
   --log-opts="--full-history HEAD" --config /src/.gitleaks.toml --redact --exit-code 1'
# master 2d9d5b069: 4752 commits scanned, no leaks found, exit 0

Negative control: with the --log-opts line removed, test_scans_checked_out_history_only fails.

Scope change: branches without an open pull request are no longer scanned by this job. GitHub secret scanning still covers every push.

🤖 Generated with Claude Code