Merge branch 'main' into dependabot/cargo/serde_json-1.0.150

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -49,6 +49,18 @@ jobs:
 
           findings =
             tracked_files
+            |> Enum.reject(fn rel_path ->
+              # Known safe test files/docs containing mock credentials
+              rel_path in [
+                "emergency-room/src/zig/capture_test.zig",
+                "czech-file-knife/docs/DISTRIBUTED_FILESYSTEMS.md",
+                "hybrid-automation-router/test/attestation/a2ml_test.exs",
+                "hybrid-automation-router/test/data_plane/transformers/kubernetes_test.exs",
+                "hybrid-automation-router/docs/HAR_SECURITY.md",
+                "cicada/scripts/verify_rsr.jl",
+                "session-sentinel/.envrc"
+              ]
+            end)
             |> Enum.flat_map(fn rel_path ->
               abs_path = Path.join(repo, rel_path)
 
@@ -277,15 +289,15 @@ jobs:
           PATTERNS=(
             'const.*SECRET.*=.*"'
             'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
-            'const.*TOKEN.*=.*"'
+            'const.*TOKEN.*=.*"[a-zA-Z0-9\-_]{16,}"'
             'let.*api_key.*=.*"'
             'HMAC.*"[a-fA-F0-9]{32,}"'
             'password.*=.*"[^"]+"'
           )
 
           found=0
           for pattern in "${PATTERNS[@]}"; do
-            if grep -rn --include="*.rs" -E "$pattern" src/; then
+            if grep -rn --include="*.rs" -E "$pattern" src/ | grep -v "supersecretvalue123"; then
               echo "WARNING: Potential hardcoded secret found matching: $pattern"
               found=1
             fi