This repository was archived by the owner on Jul 23, 2026. It is now read-only.
v1.2 - Azure VPN end-to-end; same YubiKey unlocks AD AND cloud #65
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret & Sensitive File Scan | |
| # Server-side backstop for the local pre-commit hook. Runs on every push and | |
| # pull request and fails the build if a blocked file type or a private key is | |
| # present in the tracked tree. | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Scan tracked files for sensitive types | |
| run: | | |
| set -e | |
| echo "Scanning tracked files for blocked extensions and paths..." | |
| FOUND=0 | |
| # Blocked extensions | |
| BLOCKED='pfx|p12|cer|crt|der|pem|csr|key|vmdk|ova|ovf|vmem|vmsd|vhdx|edb|jrs|bak|backup|wbk' | |
| MATCHES=$(git ls-files | grep -iE "\.(${BLOCKED})$" || true) | |
| if [ -n "$MATCHES" ]; then | |
| echo "::error::Blocked file types committed:" | |
| echo "$MATCHES" | |
| FOUND=1 | |
| fi | |
| # Blocked paths / filenames | |
| PATHS=$(git ls-files | grep -iE '(^|/)CertLog/|ConsoleHost_history\.txt|\.scrub-patterns\.local\.json' || true) | |
| if [ -n "$PATHS" ]; then | |
| echo "::error::Blocked paths/filenames committed:" | |
| echo "$PATHS" | |
| FOUND=1 | |
| fi | |
| if [ "$FOUND" -eq 1 ]; then | |
| echo "Security violation: sensitive files are tracked. See security/POLICY.md." | |
| exit 1 | |
| fi | |
| echo "No blocked file types or paths found." | |
| - name: Scan tracked text files for private key material | |
| run: | | |
| set -e | |
| echo "Scanning tracked files for embedded private keys..." | |
| HITS=$(git grep -lE "BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY" -- . || true) | |
| if [ -n "$HITS" ]; then | |
| echo "::error::Files contain PRIVATE KEY material:" | |
| echo "$HITS" | |
| echo "See security/INCIDENT_RESPONSE.md — rotate the key and purge history." | |
| exit 1 | |
| fi | |
| echo "No private key material found." |