secret-scanner.yml

# SPDX-License-Identifier: MPL-2.0
# Prevention workflow - scans for hardcoded secrets before they reach main
name: Secret Scanner
on:
  pull_request:
  push:
    branches: [main]
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  trufflehog:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
        with:
          fetch-depth: 0 # Full history for scanning
      - name: TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3
        with:
          # The v3 action injects --fail automatically on pull_request events.
          # Passing --fail here triggers "flag 'fail' cannot be repeated".
          extra_args: --only-verified

  gitleaks:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
        with:
          fetch-depth: 0

      - name: Gitleaks Secret Scan
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Rust-specific: Check for hardcoded crypto values
  rust-secrets:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4

      - name: Check for hardcoded secrets in Rust
        run: |
          if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
            echo 'No Cargo.toml found — skipping Rust secrets check'
            exit 0
          fi
          # Patterns that suggest hardcoded secrets
          PATTERNS=(
            'const.*SECRET.*=.*"'
            'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
            'const.*TOKEN.*=.*"'
            'let.*api_key.*=.*"'
            'HMAC.*"[a-fA-F0-9]{32,}"'
            'password.*=.*"[^"]+"'
          )

          found=0
          for pattern in "${PATTERNS[@]}"; do
            if grep -rn --include="*.rs" -E "$pattern" src/; then
              echo "WARNING: Potential hardcoded secret found matching: $pattern"
              found=1
            fi
          done

          if [ $found -eq 1 ]; then
            echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
            exit 1
          fi