Repository navigation
feat(training): add content-bound approval and append-only export ledger #806
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Credential Scan | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| jobs: | |
| scan: | |
| name: Detect Default Credentials | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Scan for hardcoded credentials | |
| run: | | |
| FORBIDDEN_PATTERNS=( | |
| "admin123" | |
| "omnimedical_dev" | |
| "change-me-in-production" | |
| "omnimedical_secure" | |
| "omnimedical_standard" | |
| "dev-secret-key-change-in-production" | |
| "standard-mode-change-this" | |
| "dev-only-change-in-production" | |
| "SecureMedicalPIN123" | |
| ) | |
| # Files where these patterns are EXPECTED and therefore safe to ignore: | |
| # - .env.example / .env.test / .env.* (template files showing what to set) | |
| # - docs/**SECURITY.md (documentation explaining the patterns) | |
| # - .github/workflows/credential-scan.yml (this file — lists the patterns) | |
| # - **/vba-templates.md (VBA macro documentation templates) | |
| # - packages/doc_processor/doc-processor/** (legacy copy of doc_processor — read-only mirror) | |
| # | |
| # Production code (route.ts, docker-compose.yml, test_core.py) is NOT excluded — | |
| # real credentials in those files must be fixed at the source. | |
| FOUND=0 | |
| for pattern in "${FORBIDDEN_PATTERNS[@]}"; do | |
| MATCHES=$(git grep -il "$pattern" \ | |
| ':(exclude).github/workflows/credential-scan.yml' \ | |
| ':(exclude)**/.env.example' \ | |
| ':(exclude)**/.env.test' \ | |
| ':(exclude)**/.env.*' \ | |
| ':(exclude)**/docs/SECURITY.md' \ | |
| ':(exclude)**/vba-templates.md' \ | |
| ':(exclude)packages/doc_processor/doc-processor/**' \ | |
| 2>/dev/null || true) | |
| if [ -n "$MATCHES" ]; then | |
| echo "::error::Found forbidden pattern '$pattern' in:" | |
| echo "$MATCHES" | sed 's/^/ /' | |
| FOUND=1 | |
| fi | |
| done | |
| if [ "$FOUND" -eq 1 ]; then | |
| echo "::error::Default credentials detected in production code. Remove before merging." | |
| exit 1 | |
| fi | |
| echo "No default credentials found in production code." |