From af6def941515eb3152b1143b3309e56b67619f2a Mon Sep 17 00:00:00 2001 From: Joe Blau Date: Tue, 27 Oct 2026 20:04:47 -0700 Subject: [PATCH] chore(security): run scheduled security scans at 2 AM Pacific --- .github/workflows/security-nightly.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security-nightly.yml b/.github/workflows/security-nightly.yml index da7f76d..c652b65 100644 --- a/.github/workflows/security-nightly.yml +++ b/.github/workflows/security-nightly.yml @@ -3,8 +3,10 @@ name: security-nightly on: schedule: - - cron: "38 13 * * 1-6" # Mon-Sat 13:38 UTC: incremental secrets window - - cron: "38 13 * * 0" # Sunday: full git history for gitleaks + - cron: "39 2 * * 1-6" # Mon-Sat 2:39 AM Pacific: incremental secrets window + timezone: "America/Los_Angeles" + - cron: "39 2 * * 0" # Sunday 2:39 AM Pacific: full git history for gitleaks + timezone: "America/Los_Angeles" workflow_dispatch: inputs: secrets-mode: @@ -38,7 +40,7 @@ jobs: runs-on: '["self-hosted","macOS","ARM64"]' profile: nightly enforce-workflow-lint: true # actionlint + zizmor (medium+) must pass; clean as of 2026-10-26 - secrets-mode: ${{ inputs.secrets-mode || (github.event.schedule == '38 13 * * 0' && 'full' || 'incremental') }} + secrets-mode: ${{ inputs.secrets-mode || (github.event.schedule == '39 2 * * 0' && 'full' || 'incremental') }} deps: false # secrets only: no dependency manifests to scan upload-sarif: false # no GHAS code scanning upload-secret-report: false