name: security-scan

# Max-heuristic push safeguard (server-side). gitleaks = entropy + 150+ curated
# secret rules over full history; plus key/.env/weight-file and private-IP checks.
# Any hit fails the check and blocks the merge. .gitleaks.toml allowlists confirmed
# false-positives (test fixtures, doc placeholders) per repo.

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: gitleaks (entropy + curated rules, full history)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: key / .env / weight files
        if: always()
        run: |
          HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true)
          if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi
          echo "OK: no key/.env/weight files."
      - name: private IPs (RFC1918)
        if: always()
        run: |
          IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
          if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.json' --include='*.yaml' --include='*.yml' --include='*.sh' --include='*.md' --exclude-dir=.git --exclude-dir=.github . ; then
            echo "::error::private (RFC1918) IP — use the 192.0.2.0/24 doc range in examples."; exit 1
          fi
          echo "OK: no private IPs."