♻️ use shared betterleaks

.github/workflows/_static-analysis.yml

@@ -12,34 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
-      with:
-        # Betterleaks scans git history across refs, so it needs the full
-        # history rather than the default shallow clone.
-        fetch-depth: 0
-
-    - name: Run Betterleaks
-      id: betterleaks
-      continue-on-error: true
-      # version 0.1.0
-      uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515
-      with:
-        version: "v1.9.0"
-        report-path: betterleaks-report.sarif
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Upload Betterleaks report
-      uses: actions/upload-artifact@v7
-      if: always()
-      with:
-        name: betterleaks-report
-        if-no-files-found: warn
-        path: ${{ steps.betterleaks.outputs.report-path }}
-
-    - name: Fail if Betterleaks found leaks
-      if: steps.betterleaks.outcome == 'failure'
-      run: |
-        echo "Betterleaks reported a failure in at least one scan."
-        exit 1
 
     - name: Set up Python
       uses: actions/setup-python@v7
@@ -73,6 +45,7 @@ jobs:
 
     - name: Run all static analysis
       env:
+        # betterleaks is run in a separate workflow
         SKIP: betterleaks,sphinx-html,sphinx-linkcheck
       run: |
         prek run --all-files

.github/workflows/pull-request.yml

@@ -10,12 +10,16 @@ permissions:
 jobs:
   workflow-lint:
     uses: mindee/client-lib-actions/.github/workflows/workflow-lint.yml@main
+  betterleaks:
+    uses: mindee/client-lib-actions/.github/workflows/betterleaks.yml@main
+    needs: workflow-lint
+    secrets: inherit
   static-analysis:
     uses: ./.github/workflows/_static-analysis.yml
     needs: workflow-lint
   test-units:
     uses: ./.github/workflows/_test-units.yml
-    needs: static-analysis
+    needs: [ betterleaks, static-analysis ]
     secrets: inherit
   test-regressions:
     uses: ./.github/workflows/_test-regressions.yml

.github/workflows/push-main-branch.yml

@@ -6,15 +6,18 @@
       - main
 
 jobs:
+  betterleaks:
+    uses: mindee/client-lib-actions/.github/workflows/betterleaks.yml@main
+    secrets: inherit
   static-analysis:
-    uses: mindee/mindee-api-python/.github/workflows/_static-analysis.yml@main
-  test_units:
-    uses: mindee/mindee-api-python/.github/workflows/_test-units.yml@main
-    needs: static-analysis
+    uses: mindee/mindee-api-ruby/.github/workflows/_static-analysis.yml@main
+  test-units:
+    uses: mindee/mindee-api-ruby/.github/workflows/_test-units.yml@main
+    needs: [ betterleaks, static-analysis ]
     secrets: inherit
   tag:
     uses: mindee/client-lib-actions/.github/workflows/tag-version.yml@main
-    needs: test_units
+    needs: test-units
   release:
     uses: mindee/client-lib-actions/.github/workflows/create-release.yml@main
     needs: tag