From 1a153ded400bd7a8f1b6ef01a49f65cd0ec75f40 Mon Sep 17 00:00:00 2001
From: Sev7eNup <79143581+Sev7eNup@users.noreply.github.com>
Date: Sat, 15 Aug 2026 17:47:21 +0200
Subject: [PATCH] Scan secrets once per change instead of twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `push` trigger carried no branch filter, so every push to a topic branch
started a scan and the pull_request event started a second one over the same
commits — plainly visible as two "Secret scan" runs on each Dependabot PR.

The existing concurrency group does not merge them. The push run keys on
`github.ref`, the PR run on `github.event.pull_request.number`, so the two land
in different groups and neither cancels the other.

Scoping `push` to main keeps both cases that matter: branch commits are scanned
through `pull_request`, and main keeps a run of its own — the one that scans all
reachable history after a merge.
---
 .github/workflows/secret-scan.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index e864b3b..52e11e1 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -1,7 +1,14 @@
 name: Secret scan
 
 on:
+  # `push` is scoped to main deliberately. Unscoped, every push to a topic branch scanned it once
+  # and the pull_request event scanned the same commits again moments later — two runs per change,
+  # visible on every Dependabot branch. The `concurrency` group below does not collapse them: the
+  # push run keys on `github.ref` while the PR run keys on the PR number, so they land in different
+  # groups. Branch work stays covered by `pull_request`; main keeps its own run because that is the
+  # one scanning all reachable history after a merge.
   push:
+    branches: [main]
   pull_request:
   merge_group:
   workflow_dispatch: