From f4916bea63d2be6d0a70cab2fdac5202aa25b638 Mon Sep 17 00:00:00 2001
From: yyovil <itsyyovil@gmail.com>
Date: Sun, 19 Apr 2026 18:49:04 +0530
Subject: [PATCH] fix: select matching gitleaks binary for arm64 runners

---
 .github/workflows/security.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index f0270d081..5f8cf574d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -29,7 +29,22 @@ jobs:
           set -euo pipefail
           GITLEAKS_VERSION="8.24.3"
           GITLEAKS_BASE_URL="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
-          ARCHIVE_NAME="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          RUNNER_ARCH="$(uname -m)"
+
+          case "${RUNNER_ARCH}" in
+            x86_64|amd64)
+              GITLEAKS_ARCH="x64"
+              ;;
+            aarch64|arm64)
+              GITLEAKS_ARCH="arm64"
+              ;;
+            *)
+              echo "Unsupported runner architecture: ${RUNNER_ARCH}" >&2
+              exit 1
+              ;;
+          esac
+
+          ARCHIVE_NAME="gitleaks_${GITLEAKS_VERSION}_linux_${GITLEAKS_ARCH}.tar.gz"
 
           # Download gitleaks archive using the release filename so checksum verification works
           curl -sSfL "${GITLEAKS_BASE_URL}/${ARCHIVE_NAME}" -o "${ARCHIVE_NAME}"