Repository navigation

ci: remove VAULT_ADDR override, fix stale create_key comment #33

	name: Security Scan

	on:
	pull_request:
	branches: [ main ]
	schedule:
	- cron: '23 4 * * 1'

	permissions:
	contents: read

	jobs:
	secret-scan:
	name: Secret scanning
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0

	- name: TruffleHog secret scan
	uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b # main
	with:
	extra_args: --only-verified

	dependency-review:
	name: Dependency review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Dependency review
	uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

	codeql:
	name: CodeQL analysis
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Set up JDK 21
	uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
	with:
	java-version: '21'
	distribution: 'temurin'

	- name: Initialize CodeQL
	uses: github/codeql-action/init@3d8036cf7fe7433e4a725cf513a6ea56c7fd0f14 # codeql-bundle-v2.25.0
	with:
	languages: java

	- name: Setup Gradle
	uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1

	- name: Build
	run: ./gradlew build -x test

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@3d8036cf7fe7433e4a725cf513a6ea56c7fd0f14 # codeql-bundle-v2.25.0