pssecret-scanner.yml

name: PSSecretScanner

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: pssecret-${{ github.ref }}
  cancel-in-progress: false

jobs:
  pssecret-scanner:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      # PowerShell is available by default on ubuntu-latest, so no setup step is required
      - name: Install PSSecretScanner
        shell: pwsh
        run: |
          Install-Module -Name PSSecretScanner -Force -Scope CurrentUser
      - name: Create .ignoresecrets file
        run: |
          echo "CHANGELOG.md" >> .ignoresecrets
          echo "CNAME" >> .ignoresecrets
      - name: Run PSSecretScanner
        shell: pwsh
        continue-on-error: true
        run: |
          Import-Module PSSecretScanner
          if (Test-Path .ignoresecrets) {
            $results = Find-Secret -Path . -Excludelist .ignoresecrets
          } else {
            $results = Find-Secret -Path .
          }
          $results | Format-Table | Out-String | Write-Host
          if ($results) { Write-Error 'Secrets found!'; exit 1 } else { Write-Host 'No secrets found.' }