[screen-gd]

Bottom of the stack: #15 → #16 → #17

Merge order: #15, then #16, then #17. delete_branch_on_merge is off, so click Delete branch after each merge; that makes GitHub retarget the next PR to main.

Summary

Adds a CI check that fails when a pull request or a push to main adds a secret. A Google API key reached .env.example in 04f8ab5 and was only removed by hand in the next commit.

+.github/workflows/secret-scan.yml   # gitleaks 8.30.1 (sha256-checked) on the new commits only
+.gitleaks.toml                      # built-in rules + comfy-api-key, .agents/ allowlisted

on pull_request | push to main
  checkout (full history)
  gitleaks git --log-opts "<base>..<head>" --redact
    fail on any finding

.agents/ is allowlisted because the vendored skill docs use sample tokens in their examples (11 findings in 2002dfe, all docs).

Evidence

• Before: nothing checks commits. 04f8ab5 added a live-format Google key to .env.example.
  After: this config reports gcp-api-key .env.example@04f8ab5 on that commit, and the scan exits 1.
• Full history of main with this config: one finding, the same revoked key.
• This PR's own commit range: no leaks found, exit 0.
• The key itself was revoked. The Gemini API rejects it with API_KEY_INVALID.

Merge Danger

Door: two-way

Blast Radius: CI

New PRs fail if they add a key-shaped string. A false positive can be allowlisted in .gitleaks.toml.

Summary by CodeRabbit

• Chores
  • Added automated secret scanning for pull requests and pushes to the main branch, helping catch exposed credentials before changes are merged.
  • Scanning now recognizes an additional credential-like token pattern and excludes specified agent-related paths.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d4a0225e-9bbc-4d20-84b0-383995e5d9b2

📥 Commits

Reviewing files that changed from the base of the PR and between 077dcb2 and d1556fe.

📒 Files selected for processing: 2

• .github/workflows/secret-scan.yml
• .gitleaks.toml

+--------------------------------------------+
| `undefined` is not a business requirement. |
+--------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}