GitHub
GitHub Actions
A copy-paste job installs the package into a scratch directory, scans the full history, filters and fails on private findings.
Check out with fetch-depth: 0 so gitleaks sees the history, install the package under $RUNNER_TEMP with the job’s GITHUB_TOKEN (packages: read), then run the generator, gitleaks and the filter.
The job fails only when .summary.private is above zero and prints the count, never a value.