fix(secret-scan): avoid full-history checkout for filesystem scans

.github/workflows/README.md

@@ -127,6 +127,7 @@ for this repository's own self-tests.
 ### Secret scan — [`secret-scan-pulse.yml`](secret-scan-pulse.yml)
 
 CI enforcement lane. Runs the Pulse Secret Scanner container and publishes redacted SARIF to the repository Security tab.
+The filesystem scan covers checked-out files, not Git history. Its shallow checkout avoids downloading unrelated branch histories.
 The companion local-advisory lane is the `secret-scan-trufflehog`.
 **pre-commit hook** (open-source [`trufflesecurity/trufflehog`](https://github.com/trufflesecurity/trufflehog)) declared in [`.pre-commit-hooks.yaml`](../../.pre-commit-hooks.yaml).
 

.github/workflows/secret-scan-pulse.yml

@@ -49,10 +49,11 @@ jobs:
     env:
       PULSE_IMAGE: ${{ vars.SECRET_SCAN_PULSE_IMAGE }}:${{ vars.SECRET_SCAN_PULSE_IMAGE_TAG }}
     steps:
-      - name: Checkout (full history for secret scan)
+      - name: Checkout source for filesystem secret scan
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
-          fetch-depth: 0
+          # The filesystem scan reads checked-out files, not Git history.
+          fetch-depth: 1
           persist-credentials: false  # don't leave GITHUB_TOKEN in .git for the scanned tree
 
       # CI self-test only. Plants a disposable finding so the negative failure_policy paths can be exercised end-to-end.

CHANGELOG.md

@@ -33,6 +33,10 @@ Additive release. Existing suite callers need no change: `enable-vuln-scan` and
 - Pin policy — the recommended pre-commit `rev:` pin is now the 40-character commit SHA with the release tag as a `# frozen:` comment, the form `pre-commit autoupdate --freeze` writes, matching the SHA pin already required for reusable workflows. Existing release-tag pins keep working; switch with `pre-commit autoupdate --freeze` at the next refresh. See [Pin policy per surface](README.md#pin-policy-per-surface).
 - Vulnerability scan — the scanner now works on a disposable copy of the checkout rather than a read-only mount of it. The consumer's working tree is still never writable by the container, but Detect's language detectors can generate the per-project metadata they need. A read-only tree made the `SETUPTOOLS` and `UV` detectors fail on any repository whose packages generate `.egg-info`, and Detect reports a failed detector as a non-zero status rather than as a partial scan, so the whole scan failed.
 
+### Fixed
+
+- Secret scan (Pulse): use a shallow checkout for the filesystem scan instead of downloading every branch and tag's history, avoiding large unrelated branches such as `gh-pages`.
+
 ### Known limitations
 
 - **SARIF publication is a follow-up.** Findings land in the job summary and an optional artifact, not the Security tab.