# ═══════════════════════════════════════════════════════════════════════════════
#  Vaultfire / Embris Protocol — Secret Scanning Workflow
#
#  Prevents private keys from ever being merged into the repository.
#  Uses the context-aware Python scanner (scripts/embris_scan.py) as the
#  single source of truth — the same scanner used by the pre-commit hook.
#
#  Zero false positives by design:
#    • Only flags 64-char hex in semantically private-key contexts
#    • Never scans .json, .sol, .md, .yaml, .lock files
#    • Hardhat test keys and project test keys are explicitly allowlisted
#    • Placeholder/zero values are ignored
#
#  Runs on every push and every pull request to main.
#  Works alongside existing CI (Values guardrails, Slither, Node.js CI, etc.)
# ═══════════════════════════════════════════════════════════════════════════════
name: "Secret Scan — Embris Protocol"

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  secret-scan:
    name: "🔐 Embris Protocol — Secret Scan"
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Run Embris Protocol secret scanner
        run: |
          python3 scripts/embris_scan.py --root . --no-color
