## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Managed by pkg_update_consumer_workflows. Byte-identical
## across consumers; this file is `cp`-ed from
## developer-meta-files/consumer-templates/.github/workflows/consumer-secrets-audit.yml.
## DO NOT hand-edit this file in the consumer repo - changes
## will be overwritten on the next propagation pass.
##
## Manual-trigger entry point. Run from the Actions tab:
## 'Secrets surface audit' > 'Run workflow'. Use as a sanity
## check after changing any reusable's 'workflow_call.secrets'
## schema or any consumer's 'secrets:' map.
##
## 'secrets: inherit' here forwards the entire repo-level +
## org-level secret set into the audit reusable, which prints
## presence flags. The audit boolean is resolved at
## expression-evaluation time, so secret values themselves never
## land in env or step output.
##
## Reusable docs:
## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-secrets-audit.yml

name: Secrets surface audit

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  audit:
    uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-secrets-audit.yml@master
    secrets: inherit
