Bump docker/setup-buildx-action from 3 to 4 #319
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| on: | |
| push: | |
| branches: ["**"] | |
| paths: | |
| - '**.ts' | |
| - '**.tsx' | |
| - '**.js' | |
| - '**.jsx' | |
| - '**.json' | |
| - '**.yml' | |
| - '**.yaml' | |
| - '**.env*' | |
| - '**.sh' | |
| pull_request: | |
| branches: ["**"] | |
| paths: | |
| - '**.ts' | |
| - '**.tsx' | |
| - '**.js' | |
| - '**.jsx' | |
| - '**.json' | |
| - '**.yml' | |
| - '**.yaml' | |
| - '**.env*' | |
| - '**.sh' | |
| jobs: | |
| secret-scan: | |
| name: Scan for leaked secrets | |
| if: github.repository == 'Eskyee/agentbot-opensource' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Run secret scanner | |
| run: | | |
| set -euo pipefail | |
| FAIL=0 | |
| check() { | |
| local label="$1" | |
| local pattern="$2" | |
| local exclude="${3:-__NONE__}" | |
| results=$(grep -rn --include="*.ts" --include="*.tsx" \ | |
| --include="*.js" --include="*.jsx" \ | |
| --include="*.env*" --include="*.json" \ | |
| --include="*.sh" --include="*.yml" \ | |
| --include="*.yaml" --include="*.md" \ | |
| -E "$pattern" . 2>/dev/null \ | |
| | grep -v "node_modules" \ | |
| | grep -v ".next" \ | |
| | grep -v "check-secrets.yml" \ | |
| | grep -v "sync-to-opensource.sh" \ | |
| | grep -v "check-secrets.sh" \ | |
| | grep -v "SYNC.md" \ | |
| | { [[ "$exclude" == "__NONE__" ]] && cat || grep -Ev "$exclude"; } \ | |
| || true) | |
| if [[ -n "$results" ]]; then | |
| echo "::error::FAIL [$label]" | |
| echo "$results" | head -20 | |
| FAIL=1 | |
| else | |
| echo "OK [$label]" | |
| fi | |
| } | |
| # Personal emails | |
| check "personal gmail" "[a-zA-Z0-9._%+-]+@gmail\.com" \ | |
| "(example@|your@|user@|test@|YOUR_ADMIN)" | |
| check "personal icloud" "[a-zA-Z0-9._%+-]+@icloud\.com" \ | |
| "YOUR_ADMIN" | |
| check "personal domains" "(rbasefm|djescaba|eskyjunglelab|raveculture)@" \ | |
| "YOUR_ADMIN" | |
| # Private infrastructure | |
| check "railway URLs" "\.up\.railway\.app" "YOUR_SOUL_SERVICE_URL" | |
| check "private subdomains" "borg-[0-9]+-production" "YOUR_SOUL_SERVICE_URL" | |
| # Personal payment wallet in .env only (not public token addresses) | |
| check ".env payment wallet" "X402_PAY_TO=0x[0-9a-fA-F]{40}" "YOUR_WALLET_ADDRESS" | |
| # Real API keys | |
| check "re_ resend key" "re_[A-Za-z0-9]{20,}" | |
| check "sk- openai key" "sk-[A-Za-z0-9]{20,}" | |
| if [[ $FAIL -eq 1 ]]; then | |
| echo "" | |
| echo "::error::Secrets detected — fix before pushing to this public repo." | |
| exit 1 | |
| fi | |
| echo "All clear — no secrets detected." |