anthropics--financial-services
wehub-resource-sync
36 行
1.1 KiB
YAML
36 行
1.1 KiB
YAML
name: secret-scan
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
gitleaks:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
fetch-depth: 0
|
|
- name: gitleaks
|
|
run: |
|
|
set -euo pipefail
|
|
curl -sSL -o gitleaks.tgz \
|
|
https://github.com/gitleaks/gitleaks/releases/download/v8.28.0/gitleaks_8.28.0_linux_x64.tar.gz
|
|
echo "a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb gitleaks.tgz" | sha256sum -c -
|
|
tar -xzf gitleaks.tgz gitleaks
|
|
./gitleaks git --redact --exit-code 1 .
|
|
- name: internal-reference scrub
|
|
run: |
|
|
set -euo pipefail
|
|
if grep -rInE '\.ant\.dev|antspace\.dev|anthropic-internal|\bgo/[a-z][a-z0-9_-]+\b' \
|
|
--include='*.md' --include='*.yaml' --include='*.yml' --include='*.json' \
|
|
--include='*.py' --include='*.sh' \
|
|
--exclude-dir=.github . ; then
|
|
echo "::error::internal Anthropic references found above"
|
|
exit 1
|
|
fi
|