secret-scanning.yml

name: Secret Scanning

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 0 * * 0'  # Weekly scan

jobs:
  secret-scanning:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for better detection

    - name: Run Gitleaks
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Check for hardcoded secrets
      run: |
        echo "Checking for common secret patterns..."
        # Check for hardcoded API keys, passwords, tokens
        if grep -rE "(api[_-]?key|apikey|secret|password|token|auth|credential|private[_-]?key)\s*=\s*['\"][^'\"]{10,}" --include="*.py" python-examples/ | grep -v "configs.py" | grep -v "from configs import" | grep -v "os.getenv" | grep -v "input(" | grep -v "#.*example" | grep -v "yoursecretkey" | grep -v "your.*token"; then
          echo "::error::Found potential hardcoded secrets in code!"
          exit 1
        fi
        echo "No hardcoded secrets found"