Runs gitleaks detect with full history before the build job.
Both test and secrets jobs must pass to gate image push.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
python:3.13-slim lacks node, which actions/checkout@v4 requires.
Run test job on bare runner with setup-python instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bake source into the image (COPY src/) so production containers
run without volume mounts. CI pipeline runs ruff + pytest then
builds and pushes harbor.mymx.me/s5p/s5p:latest on push to main.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>