@@ -32,29 +32,23 @@ jobs:
3232 echo "🔍 Scanning for hardcoded secrets..."
3333
3434 # Check for potential API keys
35- if grep -r "nutr_sk_ " --include="*.py" --include="*.json" --include="*.yml" --include="*.yaml " --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
35+ if grep -r "pdf_live_ " --include="*.py" --include="*.json" --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
3636 echo "❌ Found hardcoded API keys!"
3737 exit 1
3838 fi
3939
4040 # Check for base64 encoded secrets (common Nutrient patterns)
41- if grep -r "bnV0cl9za18 " --include="*.py" --include="*.json" --include="*.yml" --include="*.yaml " --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
41+ if grep -r "cGRmX2xpdmVf " --include="*.py" --include="*.json" --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
4242 echo "❌ Found base64 encoded API keys!"
4343 exit 1
4444 fi
4545
4646 # Check for other common secret patterns
47- if grep -rE "(sk_|pk_|nutr_sk_)" --include="*.py" --include="*.json" --include="*.yml" --include="*.yaml" -- exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
47+ if grep -rE "(sk_|pk_|nutr_sk_)" --include="*.py" --include="*.json" --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
4848 echo "❌ Found potential secret keys!"
4949 exit 1
5050 fi
5151
52- # Check for AWS/cloud secrets
53- if grep -rE "(AKIA[0-9A-Z]{16}|aws_access_key_id|aws_secret_access_key)" --include="*.py" --include="*.json" --include="*.yml" --include="*.yaml" --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.pytest_cache . 2>/dev/null; then
54- echo "❌ Found potential AWS secrets!"
55- exit 1
56- fi
57-
5852 echo "✅ No hardcoded secrets found"
5953
6054 dependency-check :
@@ -68,12 +62,10 @@ jobs:
6862 with :
6963 python-version : ' 3.12'
7064 cache : ' pip'
71- cache-dependency-path : ' pyproject.toml'
7265
7366 - name : Install dependencies
7467 run : |
75- python -m pip install --upgrade pip
76- pip install -e ".[dev]"
68+ pip install ".[dev]"
7769 pip install safety bandit
7870
7971 - name : Run Safety check
@@ -124,12 +116,10 @@ jobs:
124116 with :
125117 python-version : ' 3.12'
126118 cache : ' pip'
127- cache-dependency-path : ' pyproject.toml'
128119
129120 - name : Install dependencies
130121 run : |
131- python -m pip install --upgrade pip
132- pip install -e ".[dev]"
122+ pip install ".[dev]"
133123
134124 - name : Run additional security checks with ruff
135125 run : |
0 commit comments