# Throwaway secrets scan (card 74). Prints only file names / redacted findings.
name: scan
on: [push]

jobs:
  scan:
    runs-on: nixos
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: all branches
        run: git fetch origin '+refs/heads/*:refs/remotes/origin/*' && git branch -a && git rev-list --all | wc -l
      - name: gitleaks (redacted)
        run: nix run nixpkgs#gitleaks -- detect --source . --log-opts=--all --redact -v --no-banner || true
      - name: pattern scan (file names only)
        run: |
          scan() {
            echo "== $1"
            git rev-list --all | xargs -n 20 git grep -lIE "$1" | awk -F: '{print $2}' | sort | uniq -c || true
          }
          scan 'BEGIN [A-Z ]*PRIVATE KEY'
          scan 'sk-[A-Za-z0-9_-]{16,}'
          scan 'syt_[A-Za-z0-9]+|mct_[A-Za-z0-9]+'
          scan 'gh[pousr]_[A-Za-z0-9]{20,}'
          scan '[Bb]earer [A-Za-z0-9._-]{16,}'
          scan '(^|[^0-9a-f])[0-9a-f]{40}([^0-9a-f]|$)'
          scan '[Aa]ccess_?[Tt]oken'
          scan '[Pp]assw(or)?d'
          scan '[Aa][Pp][Ii][_-]?[Kk][Ee][Yy]'
          scan '[Tt]oken["'"'"' ]*[:=] *["'"'"'][A-Za-z0-9._-]{12,}'
          scan '10\.0\.0\.'
          scan 'nip\.io'
          scan 'surma\.technology'
          scan 'vpn\.'
          scan 'containeruser'
          scan 'vendors\.llm'
          scan 'citadel|nexus'
          echo "== all files ever"
          git rev-list --all | xargs -n 20 git ls-tree -r --name-only | sort -u | wc -l