From d1556fe02343eca5a69f711b82718d1b20a4b44d Mon Sep 17 00:00:00 2001
From: Screen <228304862+screen-gd@users.noreply.github.com>
Date: Fri, 23 Oct 2026 01:29:13 +0400
Subject: [PATCH] Fail CI when a commit adds a secret

A Comfy API key and a Google API key were both committed to .env.example
in the past. GitHub push protection did not stop the Comfy key because it
does not know that format.

The new workflow runs gitleaks 8.30.1 (checksum-verified) on the commits
each pull request or push to main adds. .gitleaks.toml extends the
built-in rules with a comfy-api-key rule and allowlists files whose
contents only look like credentials.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/secret-scan.yml | 33 +++++++++++++++++++++++++++++++
 .gitleaks.toml                    | 18 +++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 .github/workflows/secret-scan.yml
 create mode 100644 .gitleaks.toml

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 0000000..39a4fc5
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,33 @@
+name: Secret scan
+
+# Fails when a pull request or a push to main adds a commit containing a secret.
+# Rules live in .gitleaks.toml. Only the new commits are scanned, so history
+# that was already published does not block unrelated changes.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks 8.30.1
+        run: |
+          curl -sSfL -o gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz gitleaks
+
+      - name: Scan new commits
+        env:
+          RANGE: ${{ github.event_name == 'pull_request' && format('{0}..{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.sha) }}
+        run: ./gitleaks git . --redact --no-banner --log-opts="$RANGE"
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..e994f89
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,18 @@
+# Secret scanning rules for gitleaks (used by .github/workflows/secret-scan.yml).
+# Starts from the built-in gitleaks rules and adds formats they don't cover.
+title = "syllo secret scanning"
+
+[extend]
+useDefault = true
+
+# Comfy platform API keys (platform.comfy.org/profile/api-keys): "comfyui-" plus 64 hex chars.
+# The built-in rules do not recognise this format.
+[[rules]]
+id = "comfy-api-key"
+description = "Comfy platform API key"
+regex = '''\bcomfyui-[0-9a-f]{64}\b'''
+keywords = ["comfyui-"]
+
+[[allowlists]]
+description = "Vendored agent skill docs; their examples use sample tokens"
+paths = ['''^\.agents/''']