name: secret-scan

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: gitleaks
        run: |
          set -euo pipefail
          curl -sSL -o gitleaks.tgz \
            https://github.com/gitleaks/gitleaks/releases/download/v8.28.0/gitleaks_8.28.0_linux_x64.tar.gz
          echo "a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb  gitleaks.tgz" | sha256sum -c -
          tar -xzf gitleaks.tgz gitleaks
          ./gitleaks git --redact --exit-code 1 .
      - name: internal-reference scrub
        run: |
          set -euo pipefail
          if grep -rInE '\.ant\.dev|antspace\.dev|anthropic-internal|\bgo/[a-z][a-z0-9_-]+\b' \
              --include='*.md' --include='*.yaml' --include='*.yml' --include='*.json' \
              --include='*.py' --include='*.sh' \
              --exclude-dir=.github . ; then
            echo "::error::internal Anthropic references found above"
            exit 1
          fi
