This repository was archived by the owner on Jun 9, 2026. It is now read-only.

feat(wp-n5): Plan Update — sync docs to WP-N1..N4 complete #126

Workflow file for this run

	name: CI — Lint, Typecheck, Secrets

	on:
	pull_request:
	branches:
	- dev
	- main
	push:
	branches:
	- dev
	- main

	jobs:
	ci:
	name: Lint + Typecheck + Secrets
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	# ⚠️ CRITICAL: Bun only — NEVER use npm/pnpm (per TECHSTACKPREFERENCES.md)
	- name: Setup Bun
	uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest

	- name: Install dependencies
	run: bun install

	# Typecheck nur wenn tsconfig.json existiert
	- name: Typecheck (if TypeScript configured)
	run: \|
	if [ -f "tsconfig.json" ]; then
	echo "TypeScript config found — running typecheck..."
	bunx tsc --noEmit
	else
	echo "No tsconfig.json — skipping typecheck"
	fi

	# Biome lint/format nur wenn biome.json existiert
	- name: Biome Check (if configured)
	run: \|
	if [ -f "biome.json" ]; then
	echo "Biome config found — running check..."
	bunx @biomejs/biome check .
	else
	echo "No biome.json — skipping Biome check"
	fi

	# Secret Scan — case-insensitive für common patterns
	- name: Scan for hardcoded secrets
	run: \|
	# Case-insensitive check for common secret patterns with 20+ char values.
	# Covers: sk- prefixes (OpenAI-style keys), api_key/api-key/API_KEY/API-KEY/
	# client_secret with = or : assignments, values may contain letters, digits,
	# hyphens, underscores, dots.
	# Short values (< 20 chars) are excluded to avoid false positives from
	# module names like 'task-manager', 'publishTask', 'publish-task-model', etc.

	# Search in common code directories
	SEARCH_DIRS="Tools .opencode skill-packs"

	echo "🔍 Scanning for hardcoded secrets..."
	FOUND=0
	for dir in $SEARCH_DIRS; do
	if [ -d "$dir" ]; then
	echo " Scanning $dir..."
	# Find potential secrets (include YAML configs)
	# Filter: exclude example strings in documentation, BountyPrograms, test data
	RESULT=$(grep -rEin "sk-[a-zA-Z0-9._-]{20,}\|(api[_-]?key\|client[_-]?secret\|password\|token)[[:space:]][:=][[:space:]]['\"]?[a-zA-Z0-9._-]{20,}['\"]?" "$dir" --include=".ts" --include=".js" --include=".json" --include=".yaml" --include="*.yml" --exclude-dir="node_modules" 2>/dev/null \| grep -v "BountyPrograms.json" \| grep -vi "EXAMPLES OF GOOD\\|EXAMPLES OF BAD\\|claimed-task-complete-when\\|ignored-explicit-python\\|assistant-deleted-users\\|overwrote-working-code\\|asked-clarifying-question" \|\| true)

	if [ -n "$RESULT" ]; then
	# Filter out process.env references (environment variable lookups, not hardcoded secrets)
	FILTERED=$(echo "$RESULT" \| grep -vi "process\.env" \| grep -vi "\.env\.example" \|\| true)

	if [ -n "$FILTERED" ]; then
	# Only show file:line, not the content (to avoid exposing secrets in logs)
	echo "❌ Potential hardcoded secret found:"
	echo "$FILTERED" \| cut -d: -f1,2
	FOUND=1
	fi
	fi
	fi
	done

	if [ $FOUND -eq 1 ]; then
	echo ""
	echo "❌ Secret scan failed! Please remove hardcoded secrets or use environment variables."
	exit 1
	fi

	echo "✅ No obvious hardcoded secrets found"

	# Test job — vorbereitet für wenn Tests existieren
	- name: Tests (if tests exist)
	run: \|
	# Exclude node_modules to avoid finding test files in dependencies
	if find . -name ".test.ts" -o -name ".spec.ts" \| grep -v node_modules \| grep -q .; then
	echo "Test files found — running tests..."
	bun test
	else
	echo "No test files found — skipping (add tests to enable)"
	fi
	env:
	NODE_ENV: test

Navigation Menu

feat(wp-n5): Plan Update — sync docs to WP-N1..N4 complete #126

Workflow file

feat(wp-n5): Plan Update — sync docs to WP-N1..N4 complete #126

Uh oh!

Workflow file for this run