## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Reusable workflow: secret-isolation regression guard.
##
## Caller forwards via 'secrets: inherit' so this audit sees the
## same secrets context the caller has. Booleans below are
## resolved at expression-evaluation time, so secret values
## themselves never land in env or step output.
##
## No 'concurrency:' block. 'github.workflow' in a reusable
## resolves to the *original caller's* workflow name, so adding a
## concurrency group here would deadlock with the parent reusable's
## group when both run as siblings under the same caller. The
## parent caller's concurrency group already covers this audit run.

name: Secrets surface audit (reusable)

on:
  workflow_call:

permissions:
  contents: read

jobs:
  audit:
    name: Secrets surface audit
    runs-on: ubuntu-latest

    ## Fork-PR guard: a no-op unless the caller routes pull_request
    ## events into us, in which case it blocks PRs from forks. The
    ## dogfooding checkout below resolves to github.sha when the
    ## caller IS developer-meta-files - a fork PR there would mean
    ## attacker-controlled audit-script content runs in the runner.
    ## Same-repo branch PRs still run. Matches the guard on
    ## reusable-bandit/codeql/scorecard/cppcheck.
    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'

    timeout-minutes: 1
    permissions: {}
    env:
      ANTHROPIC_PRESENT: ${{ secrets.ANTHROPIC_API_KEY != '' }}
      OPENAI_PRESENT: ${{ secrets.OPENAI_API_KEY != '' }}
      COVERITY_TOKEN_PRESENT: ${{ secrets.COVERITY_SCAN_TOKEN != '' }}
      COVERITY_EMAIL_PRESENT: ${{ secrets.COVERITY_SCAN_EMAIL != '' }}
      ## Dogfood ref: caller's commit when developer-meta-files is its
      ## own caller (so a PR that modifies the script under test gets
      ## exercised); 'master' for every other caller. Routed through
      ## env for the org-wide env-routing convention (same shape as
      ## JOB_STATUS). The job-level fork-PR guard above is the actual
      ## mitigation for actions/untrusted-checkout.
      DMF_REF: ${{ github.repository == 'org-ai-assisted/developer-meta-files' && github.sha || 'master' }}
    steps:
      ## When the original caller is developer-meta-files itself
      ## (dogfooding) on a PR that modifies the audit script), check
      ## out at the caller's own commit so PR-modified scripts are
      ## exercised. For cross-repo callers, github.sha is the
      ## consumer's commit - useless for developer-meta-files - so fall
      ## back to master.
      - name: Checkout developer-meta-files (audit script)
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          repository: org-ai-assisted/developer-meta-files
          ref: ${{ env.DMF_REF }}
          path: .github/dmf
          persist-credentials: false
      - name: Probe secrets surface
        run: .github/dmf/ci/secrets-audit.sh

      - name: Emit step summary
        if: always()
        ## Route values through env and consume with shell-native
        ## expansion inside run: to avoid expression interpolation
        ## in shell arguments (CodeQL js/actions/command-injection).
        ## The 'present'/'absent' resolution is done server-side via
        ## the expression engine before the env var is assigned, so
        ## the shell only sees a constant string.
        env:
          ANTHROPIC_LABEL: ${{ env.ANTHROPIC_PRESENT == 'true' && 'present' || 'absent' }}
          OPENAI_LABEL: ${{ env.OPENAI_PRESENT == 'true' && 'present' || 'absent' }}
          COVERITY_TOKEN_LABEL: ${{ env.COVERITY_TOKEN_PRESENT == 'true' && 'present' || 'absent' }}
          COVERITY_EMAIL_LABEL: ${{ env.COVERITY_EMAIL_PRESENT == 'true' && 'present' || 'absent' }}
          JOB_STATUS: ${{ job.status }}
        run: |
          .github/dmf/ci/step-summary-emit.sh \
            --tool 'Secrets surface audit' \
            --column-header secret \
            --row "ANTHROPIC_API_KEY=${ANTHROPIC_LABEL}" \
            --row "OPENAI_API_KEY=${OPENAI_LABEL}" \
            --row "COVERITY_SCAN_TOKEN=${COVERITY_TOKEN_LABEL}" \
            --row "COVERITY_SCAN_EMAIL=${COVERITY_EMAIL_LABEL}" \
            --row "outcome=${JOB_STATUS}"
