fix(ci): add RUSTSEC-2026-0097 exception and fix gitleaks force-push

.github/workflows/ci.yml

@@ -203,13 +203,21 @@ jobs:
             | sudo tar xz -C /usr/local/bin gitleaks
       - name: Run gitleaks
         run: |
-          BEFORE="${{ github.event.before }}"
-          if [[ "$BEFORE" == "0000000000000000000000000000000000000000" ]]; then
-            # Tag push or new branch — no valid range, scan last 1 commit
-            echo "Tag/new-branch push detected — scanning HEAD~1..HEAD"
-            gitleaks detect --source . --log-opts "HEAD~1..HEAD" --verbose
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            # PR: scan only commits in the PR against its base branch.
+            # Using base ref avoids broken ranges after force-pushes.
+            BASE="origin/${{ github.event.pull_request.base.ref }}"
+            echo "PR detected — scanning ${BASE}..HEAD"
+            gitleaks detect --source . --log-opts "${BASE}..HEAD" --verbose
           else
-            gitleaks detect --source . --log-opts "${BEFORE}..${{ github.sha }}" --verbose
+            BEFORE="${{ github.event.before }}"
+            if [[ "$BEFORE" == "0000000000000000000000000000000000000000" ]]; then
+              # Tag push or new branch — no valid range, scan last 1 commit.
+              echo "Tag/new-branch push detected — scanning HEAD~1..HEAD"
+              gitleaks detect --source . --log-opts "HEAD~1..HEAD" --verbose
+            else
+              gitleaks detect --source . --log-opts "${BEFORE}..${{ github.sha }}" --verbose
+            fi
           fi
 
   deny:

deny.toml

@@ -15,6 +15,9 @@ version = 2
 ignore = [
     "RUSTSEC-2023-0071",
     "RUSTSEC-2025-0134",
+    # rand: Unsound with custom logger calling rand::rng() (RUSTSEC-2026-0097).
+    # No impact: grob does not define a custom logger accessing ThreadRng.
+    "RUSTSEC-2026-0097",
 ]
 
 # ── Licenses ─────────────────────────────────────────────────────────────────