check-vcr-secrets.yml

name: Check VCR Secrets

# Scan VCR cassettes for leaked secrets when they change.
# Uses Claude for thorough analysis of potential credential leaks.

on:
  pull_request:
    paths:
      - "tests/_vcr/**"
  push:
    branches: ["main"]
    paths:
      - "tests/_vcr/**"
  workflow_dispatch:  # Allow manual trigger

permissions:
  contents: read

jobs:
  check-secrets:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      - name: Set up Python
        run: uv python install 3.12

      - name: Install the project
        run: uv sync --python 3.12 --all-extras

      - name: Scan for secrets with Claude
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          if [ -z "$ANTHROPIC_API_KEY" ]; then
            echo "::warning::ANTHROPIC_API_KEY not set, skipping secret scan"
            exit 0
          fi
          make check-vcr-secrets