P6: CI secret scan via self-contained grep (gitleaks-action now requires a paid org license); keeps real scanning, no external dep

Author: 577-Industries

.github/workflows/demo-offline.yml

@@ -49,8 +49,21 @@ jobs:
         shell: bash
         run: bash scripts/run-demo.sh
 
-      - name: Secret scan (no secrets committed)
+      - name: Secret scan (no committed credentials)
         if: runner.os == 'Linux'
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -uo pipefail
+          echo "Scanning tracked files for real credential signatures..."
+          # High-confidence real-secret formats. The scanner-rule source files
+          # (CryptoInventory.cs, StigAnalyzer.cs) legitimately contain detection
+          # PATTERNS, and the surrogate uses a password-less synthetic (localdb)
+          # connection string by design (see EXCLUSIONS.md) — both are excluded.
+          PATTERN='AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36,}|xox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN (RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----|AIza[0-9A-Za-z_-]{35}|sk-[A-Za-z0-9]{20,}'
+          MATCHES=$(git ls-files -z \
+            | grep -zvE '(CryptoInventory\.cs|StigAnalyzer\.cs)$' \
+            | xargs -0 grep -nEI "$PATTERN" 2>/dev/null || true)
+          if [ -n "$MATCHES" ]; then
+            echo "::error::Potential real secret detected:"; echo "$MATCHES"; exit 1
+          fi
+          echo "OK: no real credential signatures in tracked files."