chore(deps): bump protobufjs and @gitlawb/openclaude #401
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scanning | |
| on: | |
| push: | |
| branches: [main, dev, production] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| secrets-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # gitleaks needs full history; shallow clone causes "stderr is not empty" | |
| - name: TruffleHog OSS | |
| uses: trufflesecurity/trufflehog@main | |
| continue-on-error: true # fails when BASE==HEAD (e.g. first push); non-blocking | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| extra_args: --filter-entropy=7 | |
| - name: GitLeaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| continue-on-error: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| - name: Scan for secrets | |
| continue-on-error: true | |
| run: | | |
| npm install --no-save detect-secrets | |
| npx detect-secrets scan --baseline-file .secrets.baseline || true | |
| - name: Check for exposed keys | |
| run: | | |
| echo "Checking for exposed API keys..." | |
| if grep -r "sk_live_" . --include="*.env" 2>/dev/null; then | |
| echo "ERROR: Live Stripe key found!" | |
| exit 1 | |
| fi | |
| if grep -r "AKIA[0-9A-Z]{16}" . --include="*.env" 2>/dev/null; then | |
| echo "ERROR: AWS key found!" | |
| exit 1 | |
| fi |