From ff3aa3ef3d1eb3fd0861b24ba6ae36a7446ca3cb Mon Sep 17 00:00:00 2001
From: Sausage Agent <sausage@matrix.surma.technology>
Date: Fri, 16 Oct 2026 20:35:13 +0000
Subject: [PATCH] throwaway: secrets scan probe (card 74)

---
 .gitea/workflows/ci.yml | 41 +++++++++++++++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4f2c458..18220bb 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,11 +1,40 @@
-# Runs on the Nix runner on nexus (label `nixos`, host executor).
-name: ci
-on: [push, pull_request]
+# Throwaway secrets scan (card 74). Prints only file names / redacted findings.
+name: scan
+on: [push]
 
 jobs:
-  check:
+  scan:
     runs-on: nixos
     steps:
       - uses: actions/checkout@v4
-      - name: nix flake check
-        run: nix flake check -L --show-trace
+        with:
+          fetch-depth: 0
+      - name: all branches
+        run: git fetch origin '+refs/heads/*:refs/remotes/origin/*' && git branch -a && git rev-list --all | wc -l
+      - name: gitleaks (redacted)
+        run: nix run nixpkgs#gitleaks -- detect --source . --log-opts=--all --redact -v --no-banner || true
+      - name: pattern scan (file names only)
+        run: |
+          scan() {
+            echo "== $1"
+            git rev-list --all | xargs -n 20 git grep -lIE "$1" | awk -F: '{print $2}' | sort | uniq -c || true
+          }
+          scan 'BEGIN [A-Z ]*PRIVATE KEY'
+          scan 'sk-[A-Za-z0-9_-]{16,}'
+          scan 'syt_[A-Za-z0-9]+|mct_[A-Za-z0-9]+'
+          scan 'gh[pousr]_[A-Za-z0-9]{20,}'
+          scan '[Bb]earer [A-Za-z0-9._-]{16,}'
+          scan '(^|[^0-9a-f])[0-9a-f]{40}([^0-9a-f]|$)'
+          scan '[Aa]ccess_?[Tt]oken'
+          scan '[Pp]assw(or)?d'
+          scan '[Aa][Pp][Ii][_-]?[Kk][Ee][Yy]'
+          scan '[Tt]oken["'"'"' ]*[:=] *["'"'"'][A-Za-z0-9._-]{12,}'
+          scan '10\.0\.0\.'
+          scan 'nip\.io'
+          scan 'surma\.technology'
+          scan 'vpn\.'
+          scan 'containeruser'
+          scan 'vendors\.llm'
+          scan 'citadel|nexus'
+          echo "== all files ever"
+          git rev-list --all | xargs -n 20 git ls-tree -r --name-only | sort -u | wc -l