scan-secrets.yml

name: Scan Secrets

on:
    push:
      branches:
        - main

jobs:
  scan-secrets:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Install detect-secrets
        run: |
          pip install detect-secrets

      - name: Scan for secrets
        run: detect-secrets scan --baseline .secrets.baseline

      - name: Check for new secrets
        run: |
          if git diff --exit-code .secrets.baseline; then
            echo "✅ No new secrets detected."
          else
            echo "❌ WARNING: Secrets detected or baseline changed!"
            exit 1
          fi