name: Secret Scan

# **No `paths:` filter, deliberately.** The credential this exists for lived in
# `app/src-tauri/src/docker/container.rs`, which `build.yml` would have skipped —
# that workflow only runs for `container/**`. A scan that can be avoided by
# touching the wrong directory is not a scan.
#
# This is the half of the check that nobody can bypass. The pre-commit hook in
# `.githooks/` is faster and friendlier, but it is opt-in per clone and
# `--no-verify` skips it; both are true of every git hook and neither is fixable
# from inside a repository.

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The whole tracked tree, not just the diff. Scanning a range is cheaper
      # but depends on getting the range right across pushes, force-pushes,
      # merges and PR events — and a wrong range fails *open*. The full scan
      # takes under half a second on this repository and cannot be evaded by
      # arranging for the interesting commit to sit outside the window.
      - name: Scan tracked files for credentials
        run: sh scripts/scan-secrets.sh --tracked