Notification Rule Processing Engine #2

	name: Reject GitHub secrets

	on:
	pull_request:
	types: [opened, synchronize, reopened]
	push:
	branches:
	- main
	- release-*

	permissions: {}

	jobs:
	reject-gh-secrets:
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- name: Checkout
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
	with:
	persist-credentials: false

	- name: Grep for secrets accesses
	run: \|
	if grep -E '\$\{\{\ssecrets\s\.\s[a-zA-Z0-9_\-]+\s\}\}' .github/workflows/*.yml \| grep -vF 'secrets.GITHUB_TOKEN' \| grep -vF '# nolint:reject-gh-secrets'; then
	echo "Found secrets access in the codebase. Please remove it in favour of Vault secrets."
	echo "If you are sure this is correct, add '# nolint:reject-gh-secrets' to the end of the line. Be VERY careful with this."
	exit 1
	fi

Provide feedback