From 03014bde8c12ad2216c06c633e6ec01388b8102f Mon Sep 17 00:00:00 2001
From: Thierno Bah <44367278+soulbah@users.noreply.github.com>
Date: Fri, 9 Oct 2026 06:17:23 +0200
Subject: [PATCH] fix(policy-packs): install gitleaks before the repository
 check

---
 .github/workflows/publish-policy-packs.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/publish-policy-packs.yml b/.github/workflows/publish-policy-packs.yml
index 6b6031d..85ba573 100644
--- a/.github/workflows/publish-policy-packs.yml
+++ b/.github/workflows/publish-policy-packs.yml
@@ -40,6 +40,20 @@ jobs:
       - name: Install exact dependencies
         run: bun install --frozen-lockfile
 
+      - name: Install verified Gitleaks
+        env:
+          GITLEAKS_ARCHIVE: gitleaks_8.30.1_linux_x64.tar.gz
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          set -euo pipefail
+          curl --fail --silent --show-error --location \
+            --output "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v$GITLEAKS_VERSION/$GITLEAKS_ARCHIVE"
+          printf '%s  %s\n' "$GITLEAKS_SHA256" "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" | sha256sum --check --strict
+          tar --extract --gzip --file "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" --directory "$RUNNER_TEMP" gitleaks
+          printf '%s\n' "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
       - name: Validate publication inputs and source
         id: inputs
         env: