From 40f3a03173dd5455a87af37159f45978dc54ab28 Mon Sep 17 00:00:00 2001
From: levineam <levineam@gmail.com>
Date: Fri, 14 Aug 2026 14:31:49 -0400
Subject: [PATCH] fix: restore broad CI secret scanning

---
 .github/workflows/ci.yml                 | 14 +++++---------
 scripts/filter-secret-scan-candidates.sh |  5 +++--
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa3363e5..d6a20ce1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -138,22 +138,18 @@ jobs:
             base="${{ github.event.before }}"
           fi
 
-          pattern='(ghp_|sk-[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|api[_-]?key[[:space:]]*[:=]|private[_-]?key[[:space:]]*[:=]|access[_-]?token[[:space:]]*[:=]|bearer[_-]?token[[:space:]]*[:=]|password[[:space:]]*[:=]|secret[_-]?key[[:space:]]*[:=]|auth[_-]?token[[:space:]]*[:=])'
-          sensitive_exts=(
-            '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs'
-            '*.py' '*.sh' '*.bash'
-            '*.yml' '*.yaml' '*.json' '*.toml' '*.ini' '*.cfg'
-            '.env*'
-          )
+          pattern='(ghp_|sk-[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|([A-Za-z0-9]+[_-])?(secret|token|bearer)([_-][A-Za-z0-9]+)*[[:space:]]*[:=]|api[_-]?key[[:space:]]*[:=]|private[_-]?key[[:space:]]*[:=]|password[[:space:]]*[:=])'
 
           if [[ -z "$base" || "$base" =~ ^0+$ ]] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
-            if git grep -nI -E "$pattern" -- "${sensitive_exts[@]}" ':!.github/workflows/ci.yml' \
+            if git grep -nIi -E "$pattern" -- . \
               | bash scripts/filter-secret-scan-candidates.sh; then
               echo "Potential secret pattern detected in repository history scan."
               exit 1
             fi
           else
-            if git diff -U0 "$base"...HEAD -- "${sensitive_exts[@]}" ':!.github/workflows/ci.yml' \
+            if git diff -U0 "$base"...HEAD -- \
+              | grep -E '^\+' \
+              | grep -Ev '^\+\+\+' \
               | grep -E -i "$pattern" \
               | bash scripts/filter-secret-scan-candidates.sh; then
               echo "Potential secret pattern detected in changed content."
diff --git a/scripts/filter-secret-scan-candidates.sh b/scripts/filter-secret-scan-candidates.sh
index 58130213..9c983a78 100644
--- a/scripts/filter-secret-scan-candidates.sh
+++ b/scripts/filter-secret-scan-candidates.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-safe_github_secret_reference='^([^:]+:[0-9]+:|\+)[[:space:]]*[A-Za-z0-9_-]+[[:space:]]*:[[:space:]]*\$\{\{[[:space:]]*secrets\.[A-Za-z_][A-Za-z0-9_]*[[:space:]]*\}\}[[:space:]]*$'
+safe_reference='^([^:]+:[0-9]+:|[-+])[[:space:]]*[A-Za-z0-9_-]+[[:space:]]*:[[:space:]]*\$\{\{[[:space:]]*secrets\.[A-Za-z_][A-Za-z0-9_]*[[:space:]]*\}\}[[:space:]]*$'
+scan_definition='^([^:]+:[0-9]+:|[-+])[[:space:]]*(pattern|safe_github_secret_reference)='
 
-grep -Eiv "$safe_github_secret_reference"
+grep -Eiv "$safe_reference|$scan_definition"