secret-scanning.yml

name: Secret Scanning

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 0 * * 0'  # Weekly scan

jobs:
  secret-scanning:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for better detection

    - name: Run Gitleaks
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Check for hardcoded secrets
      run: |
        echo "Checking for common secret patterns..."
        # Check for hardcoded API keys, passwords, tokens
        # Exclude: configs.py, imports, os.getenv, input(), examples, f-strings with variables
        if grep -rE "(api[_-]?key|apikey|secret|password|token|auth|credential|private[_-]?key)\s*=\s*['\"][^'\"]{10,}" --include="*.py" python-examples/ | \
           grep -v "configs.py" | \
           grep -v "from configs import" | \
           grep -v "os.getenv" | \
           grep -v "input(" | \
           grep -v "#.*example" | \
           grep -v "yoursecretkey" | \
           grep -v "your.*token" | \
           grep -vE "f[\"'].*\{.*(password|api|secret|token|auth|credential)" | \
           grep -vE "['\"].*\{.*\}.*['\"]"; then
          echo "::error::Found potential hardcoded secrets in code!"
          exit 1
        fi
        echo "No hardcoded secrets found"