[ianardee]

Description

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Requires a change to the official Guide documentation.

[Copilot]

🟡 Changes recommended

The history scan can miss secrets introduced by merge resolutions, so a separate directory scan is needed to prevent that coverage gap.

1 open issue

• Retain directory scan to catch secrets in merge resolutions · New

What changed in this PR

This PR makes Betterleaks consistently use Git-history scanning in the reusable static-analysis workflow.

Changes:

• Explicitly sets Betterleaks to git mode.
• Documents why checkout retains full Git history.
• Skips the Betterleaks pre-commit hook when running the remaining static checks.

File	Description
.github/​workflows/​_static-analysis.yml	Sets Git scan mode, explains full-history checkout, and excludes Betterleaks from the prek run.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The scan can fail clean PRs on unrelated historical findings, miss secrets introduced by merge commits, and expose credentials in uploaded report metadata.

2 open issues

• All-ref scan fails PRs on unrelated historical findings · New
• Git report may expose credentials in commit messages · New

1 resolved since last review

• Retain directory scan to catch secrets in merge resolutions

_{Review effort: Balanced}