From 893aa7d48c964e9dbe6891bfb3f810566545b133 Mon Sep 17 00:00:00 2001
From: powersagitar <114868133+powersagitar@users.noreply.github.com>
Date: Fri, 16 Oct 2026 14:34:55 -0400
Subject: [PATCH] ci: add gitleaks secret scan to detect committed API
 credentials

Scan the full git history on pushes to main and on PRs, failing the
build if a key, token or other credential is found. The two Healthchecks
API keys previously hardcoded in internal/status are allowlisted by
fingerprint in .gitleaksignore, since they remain in history; the keys
themselves have already been removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/secret-scan.yml | 37 +++++++++++++++++++++++++++++++
 .gitleaksignore                   |  6 +++++
 2 files changed, 43 insertions(+)
 create mode 100644 .github/workflows/secret-scan.yml
 create mode 100644 .gitleaksignore

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 0000000..2163bba
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,37 @@
+name: Secret scan
+
+# Fails if an API key, token or other credential is committed anywhere in the
+# repository's history. Uses the gitleaks CLI directly (gitleaks-action needs
+# a paid license for organization repos). Known historical findings are
+# allowlisted by fingerprint in .gitleaksignore.
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_VERSION: 8.28.0
+      GITLEAKS_SHA256: a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${TARBALL}"
+          echo "${GITLEAKS_SHA256}  ${TARBALL}" | sha256sum -c -
+          tar -xzf "$TARBALL" gitleaks
+          sudo mv gitleaks /usr/local/bin/
+
+      - name: Scan git history
+        run: gitleaks git --redact --verbose .
diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..6fb00c5
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,6 @@
+# Known historical leaks: Healthchecks API keys hardcoded in the since-removed
+# internal/status package. The keys have been removed, but they remain in git
+# history, so they are allowlisted by fingerprint here.
+# Do not add new entries for real secrets — remove the secret and rotate it.
+03293f2e471b05dc6327ebb9d95144ce89ea433d:internal/status/status.go:generic-api-key:46
+bd9c129a0c64e8b0a293d8eaf03f48554b3475f1:internal/status/status.go:generic-api-key:47