`.github/workflows/ci.yml`

83 lines
name: ci

on:
  push:
    branches: ["main"]
  pull_request:

permissions:
  contents: read

jobs:
  safety-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Verify repo structure
        run: |
          set -euo pipefail
          for dir in posts snippets skills; do
            test -d "$dir" || { echo "Missing directory: $dir"; exit 1; }
          done
          for file in README.md LICENSE SECURITY.md; do
            test -f "$file" || { echo "Missing file: $file"; exit 1; }
          done
          echo "Structure OK"

      - name: Redaction lint all posts
        run: |
          set -euo pipefail
          found=0
          for f in posts/*.md; do
            [ -f "$f" ] || continue
            python3 snippets/redact_lint.py "$f"
            found=$((found + 1))
          done
          echo "Linted $found posts"

      - name: Validate skills JSON
        run: python3 snippets/validate_skills.py

      - name: Scan for known sensitive tokens
        run: |
          python3 - << 'PY'
          import os, sys
          bad = []
          needles = [
              "AKIA",
              "-----BEGIN PRIVATE KEY-----",
              "-----BEGIN RSA PRIVATE KEY-----",
              "xoxb-", "xoxp-",
              "ghp_", "gho_",
              "sk-ant-", "sk-proj-",
          ]
          skip_dirs = {".git", "node_modules", ".venv", "venv", "__pycache__"}
          exts = {".md", ".py", ".sh", ".json", ".yml", ".yaml", ".txt", ".toml"}
          for root, dirs, files in os.walk("."):
              dirs[:] = [d for d in dirs if d not in skip_dirs]
              for f in files:
                  if not any(f.endswith(e) for e in exts):
                      continue
                  p = os.path.join(root, f)
                  try:
                      txt = open(p, "r", encoding="utf-8", errors="replace").read()
                  except Exception:
                      continue
                  for n in needles:
                      if n in txt:
                          bad.append((p, n))
          if bad:
              print("FAIL: Potential sensitive tokens found:")
              for p, n in bad:
                  print(f"  {p}: contains '{n}'")
              sys.exit(1)
          print("OK: No sensitive tokens detected")
          PY