From f2797cd4ad67908743e044cea1c642e753aff977 Mon Sep 17 00:00:00 2001
From: Manasjyoti Sharma <manas@fortifyroot.com>
Date: Sat, 28 Mar 2026 11:47:36 +0530
Subject: [PATCH 1/2] fix(ci): add secret scan job, split all-tests into
 non-fr-tests

- Add secret-scan job (same regex as fortifyroot-sdk-py CI) as a
  prerequisite for both test jobs
- Replace all-tests with non-fr-tests (-- -m "not fr") to avoid
  overlap with fr-tests job
- Fix .env.test.example placeholders to not trigger secret scan
- Remove pip cache config (we use uv, not pip)
---
 .env.test.example            |  8 ++++----
 .github/workflows/fr-pr.yaml | 23 +++++++++++++++++++++++
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/.env.test.example b/.env.test.example
index e1d35cdc1f..b3f7d6404e 100644
--- a/.env.test.example
+++ b/.env.test.example
@@ -13,16 +13,16 @@
 
 # --- LLM Provider API Keys (for cassette recording) ---
 # OpenAI: https://platform.openai.com/api-keys
-OPENAI_API_KEY=sk-replace-with-real-key
+OPENAI_API_KEY=YOUR_OPENAI_KEY_HERE
 
 # Anthropic: https://console.anthropic.com/settings/keys
-ANTHROPIC_API_KEY=sk-ant-replace-with-real-key
+ANTHROPIC_API_KEY=YOUR_ANTHROPIC_KEY_HERE
 
 # Google AI Studio (Gemini): https://aistudio.google.com/apikey
 GOOGLE_API_KEY=replace-with-real-key
 
 # Groq: https://console.groq.com/keys
-GROQ_API_KEY=gsk_replace-with-real-key
+GROQ_API_KEY=YOUR_GROQ_KEY_HERE
 
 # Mistral: https://console.mistral.ai/api-keys/
 MISTRAL_API_KEY=replace-with-real-key
@@ -40,7 +40,7 @@ WRITER_API_KEY=replace-with-real-key
 REPLICATE_API_TOKEN=replace-with-real-key
 
 # OpenRouter (budget-friendly proxy): https://openrouter.ai/keys
-OPENROUTER_API_KEY=sk-or-replace-with-real-key
+OPENROUTER_API_KEY=YOUR_OPENROUTER_KEY_HERE
 
 # --- AWS (for Bedrock / SageMaker cassette recording) ---
 # AWS_ACCESS_KEY_ID=replace-with-real-key
diff --git a/.github/workflows/fr-pr.yaml b/.github/workflows/fr-pr.yaml
index 50e3de11d1..952f69e8cd 100644
--- a/.github/workflows/fr-pr.yaml
+++ b/.github/workflows/fr-pr.yaml
@@ -11,7 +11,29 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  secret-scan:
+    name: Secret Policy Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Fail on hardcoded provider API keys
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          regex='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,}|OPENAI_API_KEY[[:space:]]*[:=][[:space:]]*["'"'"']?sk-|OPENROUTER_API_KEY[[:space:]]*[:=][[:space:]]*["'"'"']?sk-or-|ANTHROPIC_API_KEY[[:space:]]*[:=][[:space:]]*["'"'"']?sk-ant-)'
+
+          if git grep -nI -E "$regex" -- . ':(exclude)*.lock'; then
+            echo "::error::Potential hardcoded provider key detected. Remove it and use placeholders or GitHub Secrets."
+            exit 1
+          fi
+
+          echo "No hardcoded provider key patterns detected."
+
   fr-tests:
+    needs: secret-scan
     name: FR Tests (py${{ matrix.python-version }})
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -49,6 +71,7 @@ jobs:
           if-no-files-found: ignore
 
   non-fr-tests:
+    needs: secret-scan
     name: Non-FR Tests (py${{ matrix.python-version }})
     runs-on: ubuntu-latest
     timeout-minutes: 60

From bcbdac0cd8b7c343c22da5277d756d26127185ca Mon Sep 17 00:00:00 2001
From: Manasjyoti Sharma <manas@fortifyroot.com>
Date: Sun, 29 Mar 2026 08:30:37 +0530
Subject: [PATCH 2/2] fix(ci): exclude example files and tighten secret scan
 regex

Remove overly broad KEY=sk- assignment patterns that false-positive on
placeholder strings in .env.example and documentation print statements.
Exclude *.env.example and *.env.*.example from the scan. The specific
provider key patterns (sk-proj-, sk-or-v1-, sk-ant-, gsk_) with minimum
length requirements still catch real keys.
---
 .github/workflows/fr-pr.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/fr-pr.yaml b/.github/workflows/fr-pr.yaml
index 952f69e8cd..d92e1eea55 100644
--- a/.github/workflows/fr-pr.yaml
+++ b/.github/workflows/fr-pr.yaml
@@ -23,9 +23,9 @@ jobs:
         run: |
           set -euo pipefail
 
-          regex='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,}|OPENAI_API_KEY[[:space:]]*[:=][[:space:]]*["'"'"']?sk-|OPENROUTER_API_KEY[[:space:]]*[:=][[:space:]]*["'"'"']?sk-or-|ANTHROPIC_API_KEY[[:space:]]*[:=][[:space:]]*["'"'"']?sk-ant-)'
+          regex='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,})'
 
-          if git grep -nI -E "$regex" -- . ':(exclude)*.lock'; then
+          if git grep -nI -E "$regex" -- . ':(exclude)*.lock' ':(exclude)*.env.example' ':(exclude)*.env.*.example'; then
             echo "::error::Potential hardcoded provider key detected. Remove it and use placeholders or GitHub Secrets."
             exit 1
           fi