From 85c12e3006b274656d577fa694412c7c9eb6acc4 Mon Sep 17 00:00:00 2001
From: d-oit <6849456+d-oit@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:39:59 +0200
Subject: [PATCH] fix(ci): pin gitleaks-action to v2.3.9 to remove license
 requirement

---
 .github/workflows/security-scan.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index ae3c9bcd..6f393e4e 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -140,7 +140,9 @@ jobs:
 
       - name: Secret Detection with GitLeaks
         id: gitleaks
-        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
+        # v2.3.9 pinned: v3+ requires a paid GITLEAKS_LICENSE secret.
+        # See plans/115-gitleaks-license-pre-existing-2026-08-11.md.
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7  # v2.3.9
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # Optional