source-checks.yml

name: Source checks

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  secrets:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: stable
          cache: false
      - name: Install pinned scanner
        run: go install github.com/zricethezav/gitleaks/v8@v8.30.1
      - name: Scan reachable history
        run: gitleaks git . --log-opts="--all" --redact --no-banner
      - name: Check tracked source files
        run: |
          python3 - <<'PYTHON'
          from pathlib import PurePosixPath
          import subprocess
          names = subprocess.check_output(["git", "ls-files", "-z"]).decode().split("\0")
          local_names = {"agent.md", "agents.md", "claude.md", "gemini.md", "memory.md", "program.md"}
          local_dirs = {".agents", ".claude", ".codex", ".cursor", "superpowers"}
          examples = {".env.example", ".env.sample", ".env.template"}
          rejected = []
          for name in filter(None, names):
              path = PurePosixPath(name)
              base = path.name.lower()
              if (base in local_names or any(part.lower() in local_dirs for part in path.parts)
                      or (base.startswith(".env") and base not in examples)):
                  rejected.append(name)
          if rejected:
              raise SystemExit("Local-only files are tracked: " + ", ".join(rejected))
          PYTHON