ComfyUI-OpenClaw/.github/workflows/secret-scan.yml

# Secret Scanning CI Workflow (S10)
# Runs detect-secrets on pull requests to prevent accidental secret commits

name: Secret Scan

on:
  pull_request:
    branches: [main, master]
  push:
    branches: [main, master]

permissions:
  contents: read

jobs:
  secret-scan:
    name: Detect Secrets
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install detect-secrets and pre-commit
        run: pip install detect-secrets==1.4.0 pre-commit

      - name: Run pre-commit detect-secrets hook
        run: |
          # Run detect-secrets via pre-commit for consistent behavior
          pre-commit run detect-secrets --all-files || {
            echo "::error::Secrets detected! Run 'detect-secrets audit .secrets.baseline' locally to review."
            exit 1
          }