appconfig-secret-scan.yml

name: "App Config Secret Scan"

# The exports under Config/ come from the Azure App Configuration stores and are
# committed to a public repository. App Configuration will happily hold a literal
# credential, so without this gate an export can carry one into permanent git
# history. Runs on every PR rather than filtering on paths so it stays usable as
# a required status check.
on:
  pull_request:
    branches:
      - dev
      - main
      - 'release/**'
      - 'hotfix/**'
  push:
    branches:
      - dev
      - main
      - 'release/**'
      - 'hotfix/**'
  merge_group:
    branches:
      - dev

# This job only reads the repository: checkout, then run a stdlib-only Python script over
# Config/*.json. Nothing is written back, so the token needs no more than read access.
permissions:
  contents: read

jobs:
  scan:
    name: Scan App Config exports
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Validate App Config exports
        run: python Scripts/AzureAppConfig/validate_aac_secrets.py "Config/*.json" --strict