feat(vector): fused BBQ dequantize-distance kernels with tiered SIMD dispatch #270

	# A sweep, not a per-commit gate: PRs scan only their own commits, the daily
	# run scans full history and covers direct pushes to main.

	name: Secret scan

	on:
	pull_request:
	branches: [main]
	schedule:
	- cron: "29 3 * * *"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	gitleaks:
	name: Gitleaks scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	fetch-depth: 0
	# Prebuilt release binary rather than `go install`: the latter drops the
	# binary in $(go env GOPATH)/bin, which is not on the runner's PATH, and
	# building from source costs a minute per run for no benefit.
	- name: Install Gitleaks
	env:
	GITLEAKS_VERSION: 8.30.0
	run: \|
	curl -sSfL \
	"https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
	\| sudo tar -xz -C /usr/local/bin gitleaks
	gitleaks version

	- name: Scan pull request commits
	if: github.event_name == 'pull_request'
	run: \|
	gitleaks git --redact --verbose --config .gitleaks.toml \
	--log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"

	- name: Scan full history
	if: github.event_name != 'pull_request'
	run: gitleaks git --redact --verbose --config .gitleaks.toml

Navigation Menu