TECH_DEBT: Wire federated terminology into Measure evaluation with bundle-first semantics #286

	name: "App Config Secret Scan"

	# The exports under Config/ come from the Azure App Configuration stores and are
	# committed to a public repository. App Configuration will happily hold a literal
	# credential, so without this gate an export can carry one into permanent git
	# history. Runs on every PR rather than filtering on paths so it stays usable as
	# a required status check.
	on:
	pull_request:
	branches:
	- dev
	- main
	- 'release/**'
	- 'hotfix/**'
	push:
	branches:
	- dev
	- main
	- 'release/**'
	- 'hotfix/**'
	merge_group:
	branches:
	- dev

	# This job only reads the repository: checkout, then run a stdlib-only Python script over
	# Config/*.json. Nothing is written back, so the token needs no more than read access.
	permissions:
	contents: read

	jobs:
	scan:
	name: Scan App Config exports
	runs-on: ubuntu-latest
	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'

	- name: Validate App Config exports
	run: python Scripts/AzureAppConfig/validate_aac_secrets.py "Config/*.json" --strict

Navigation Menu