From 40fedfc1968b71a926b0d869771511777b5fa6bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ianar=C3=A9=20S=C3=A9vi?= <ianare@mindee.co>
Date: Tue, 3 Nov 2026 17:12:12 +0100
Subject: [PATCH] :recycle: use shared betterleaks

---
 .github/workflows/_static-analysis.yml | 29 +-------------------------
 .github/workflows/pull-request.yml     |  6 +++++-
 .github/workflows/push-main-branch.yml | 13 +++++++-----
 3 files changed, 14 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/_static-analysis.yml b/.github/workflows/_static-analysis.yml
index cf0ab46e..7fe39fbd 100644
--- a/.github/workflows/_static-analysis.yml
+++ b/.github/workflows/_static-analysis.yml
@@ -12,34 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
-      with:
-        # Betterleaks scans git history across refs, so it needs the full
-        # history rather than the default shallow clone.
-        fetch-depth: 0
-
-    - name: Run Betterleaks
-      id: betterleaks
-      continue-on-error: true
-      # version 0.1.0
-      uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515
-      with:
-        version: "v1.9.0"
-        report-path: betterleaks-report.sarif
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Upload Betterleaks report
-      uses: actions/upload-artifact@v7
-      if: always()
-      with:
-        name: betterleaks-report
-        if-no-files-found: warn
-        path: ${{ steps.betterleaks.outputs.report-path }}
-
-    - name: Fail if Betterleaks found leaks
-      if: steps.betterleaks.outcome == 'failure'
-      run: |
-        echo "Betterleaks reported a failure in at least one scan."
-        exit 1
 
     - name: Set up Python
       uses: actions/setup-python@v7
@@ -73,6 +45,7 @@ jobs:
 
     - name: Run all static analysis
       env:
+        # betterleaks is run in a separate workflow
         SKIP: betterleaks,sphinx-html,sphinx-linkcheck
       run: |
         prek run --all-files
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index f174d414..f579417d 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -10,12 +10,16 @@ permissions:
 jobs:
   workflow-lint:
     uses: mindee/client-lib-actions/.github/workflows/workflow-lint.yml@main
+  betterleaks:
+    uses: mindee/client-lib-actions/.github/workflows/betterleaks.yml@main
+    needs: workflow-lint
+    secrets: inherit
   static-analysis:
     uses: ./.github/workflows/_static-analysis.yml
     needs: workflow-lint
   test-units:
     uses: ./.github/workflows/_test-units.yml
-    needs: static-analysis
+    needs: [ betterleaks, static-analysis ]
     secrets: inherit
   test-regressions:
     uses: ./.github/workflows/_test-regressions.yml
diff --git a/.github/workflows/push-main-branch.yml b/.github/workflows/push-main-branch.yml
index f04ba2c6..7cb8c88c 100644
--- a/.github/workflows/push-main-branch.yml
+++ b/.github/workflows/push-main-branch.yml
@@ -6,15 +6,18 @@ on:
       - main
 
 jobs:
+  betterleaks:
+    uses: mindee/client-lib-actions/.github/workflows/betterleaks.yml@main
+    secrets: inherit
   static-analysis:
-    uses: mindee/mindee-api-python/.github/workflows/_static-analysis.yml@main
-  test_units:
-    uses: mindee/mindee-api-python/.github/workflows/_test-units.yml@main
-    needs: static-analysis
+    uses: mindee/mindee-api-ruby/.github/workflows/_static-analysis.yml@main
+  test-units:
+    uses: mindee/mindee-api-ruby/.github/workflows/_test-units.yml@main
+    needs: [ betterleaks, static-analysis ]
     secrets: inherit
   tag:
     uses: mindee/client-lib-actions/.github/workflows/tag-version.yml@main
-    needs: test_units
+    needs: test-units
   release:
     uses: mindee/client-lib-actions/.github/workflows/create-release.yml@main
     needs: tag