Upgrade CI to gitleaks (entropy + curated rules, max heuristic)

.github/workflows/security-scan.yml

@@ -1,16 +1,17 @@
 name: security-scan
 
-# Repo-level safeguard: every push and PR is scanned for committed secrets,
-# private IPs and key/.env files. A hit fails the check and blocks the merge.
-# Patterns are generic (API-key/token/private-key formats, RFC1918 ranges) so
-# the workflow itself carries no sensitive data. No untrusted event input is
-# used in run: steps (injection-safe).
+# Max-heuristic push safeguard (server-side). gitleaks = entropy + 150+ curated
+# secret rules over full history; plus key/.env/weight-file and private-IP checks.
+# Any hit fails the check and blocks the merge. .gitleaks.toml allowlists confirmed
+# false-positives (test fixtures, doc placeholders) per repo.
 
 on:
   push:
-    branches: [main, master]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   secret-scan:
     runs-on: ubuntu-latest
@@ -18,24 +19,21 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Scan for committed secrets
-        run: |
-          PAT='(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{50,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|xox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|hf_[A-Za-z0-9]{30,}|nvapi-[A-Za-z0-9_-]{20,}|glpat-[A-Za-z0-9_-]{20,})'
-          if grep -rIEn "$PAT" --exclude-dir=.git --exclude-dir=.github . ; then
-            echo "::error::Potential secret/token detected — push blocked."; exit 1
-          fi
-          echo "OK: no secret/token patterns."
-      - name: Scan for private IPs
-        run: |
-          IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
-          if grep -rIEn "$IP" --include='*.py' --include='*.json' --include='*.md' --include='*.yaml' --include='*.yml' --include='*.txt' --include='*.html' --include='*.js' --exclude-dir=.git --exclude-dir=.github . ; then
-            echo "::error::Private (RFC1918) IP detected — push blocked. Use 192.0.2.0/24 in examples."; exit 1
-          fi
-          echo "OK: no private IPs."
-      - name: Scan for secret/key/weight files
+      - name: gitleaks (entropy + curated rules, full history)
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: key / .env / weight files
+        if: always()
         run: |
           HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true)
-          if [ -n "$HITS" ]; then
-            echo "::error::Secret/key/weight file committed — push blocked:"; echo "$HITS"; exit 1
-          fi
+          if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi
           echo "OK: no key/.env/weight files."
+      - name: private IPs (RFC1918)
+        if: always()
+        run: |
+          IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
+          if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.json' --include='*.yaml' --include='*.yml' --include='*.sh' --include='*.md' --exclude-dir=.git --exclude-dir=.github . ; then
+            echo "::error::private (RFC1918) IP — use the 192.0.2.0/24 doc range in examples."; exit 1
+          fi
+          echo "OK: no private IPs."