ci: add profile metadata validator + secret scanner workflows

Author: karmiphuc

.github/workflows/scan-secrets.yml

@@ -0,0 +1,72 @@
+name: Scan for leaked secrets
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+  schedule:
+    # Weekly Sunday 03:00 UTC scan (your repos are quiet on weekends)
+    - cron: "0 3 * * 0"
+
+permissions:
+  contents: read
+  issues: write   # for weekly audit issue creation
+  actions: read
+
+jobs:
+  gitleaks:
+    name: gitleaks (gate)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          # Tuned to your signal shape: prose READMEs + small CLI/Python repos
+          GITLEAKS_CONFIG: |
+            [extend]
+            useDefault = true
+            [allowlist]
+            paths = [
+              '''**/*.lock''',
+              '''**/*.png''',
+              '''**/*.jpg''',
+              '''**/*.svg''',
+              '''LICENSE''',
+              '''LICENSE.md''',
+              '''LICENSE.txt'''
+            ]
+            description = "Personal noise allowlist: lockfiles + binaries + license files only"
+
+  trufflehog-audit:
+    name: TruffleHog (weekly deep audit)
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: TruffleHog (verified only)
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --only-verified --no-banner --print-estimates=False
+
+      - name: Open audit issue if anything verified
+        if: steps.trufflehog.outputs.verified_secrets > 0
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `🔐 TruffleHog weekly audit: ${context.runId}`,
+              body: `Verified secret(s) detected by TruffleHog.\n\nRun: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}\n\nTriage immediately.`
+            });

.github/workflows/validate-profile.yml

@@ -0,0 +1,63 @@
+name: Validate profile metadata
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  metadata-check:
+    name: Description + topics + leak guard
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch repo metadata via API
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          META=$(gh api "repos/${REPO}" --jq '{description: .description, topics: [.topics[]]}')
+          echo "::group::Fetched metadata"
+          echo "${META}"
+          echo "::endgroup::"
+
+          DESC=$(echo "${META}" | jq -r '.description // ""')
+          TOPIC_COUNT=$(echo "${META}" | jq -r '.topics | length')
+
+          # Description checks
+          if [[ -z "${DESC}" || "${DESC}" == "null" ]]; then
+            echo "::error::Description is empty. Set one via: gh repo edit <owner>/<repo> --description '...'"
+            exit 1
+          fi
+          if [[ ${#DESC} -lt 20 ]]; then
+            echo "::error::Description too short (${#DESC} chars, min 20): '${DESC}'"
+            exit 1
+          fi
+          if [[ ! "${DESC}" =~ ^[A-Z] ]]; then
+            echo "::error::Description must start with a capital letter: '${DESC}'"
+            exit 1
+          fi
+
+          # Topic checks
+          if (( TOPIC_COUNT < 3 )); then
+            echo "::error::Need at least 3 topics (have ${TOPIC_COUNT}). Add via: gh repo edit <owner>/<repo> --add-topic foo"
+            exit 1
+          fi
+
+          # Internal-leak guard: block accidental exposure of internal/corporate language
+          LEAKS="company|bedrock|corporate|corp\\.|sanitized fork of a private|internal tool|not for distribution|do not share"
+          if [[ "${DESC,,}" =~ ${LEAKS} ]]; then
+            echo "::error::Description contains internal-leak phrase: '${DESC}'"
+            exit 1
+          fi
+          for t in $(echo "${META}" | jq -r '.topics[]'); do
+            if [[ "${t,,}" =~ ${LEAKS} ]]; then
+              echo "::error::Topic '${t}' matches internal-leak pattern"
+              exit 1
+            fi
+          done
+
+          echo "OK: description + topics passed all checks."