name: Reject GitHub secrets

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches:
      - main
      - release-*

permissions: {}

jobs:
  reject-gh-secrets:
    # Run on `grafana/grafana` main branch, or on pull requests to prevent double-running on mirrors
    if: (github.event_name == 'pull_request' || (github.event_name == 'push' && github.repository == 'grafana/grafana'))
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
        with:
          persist-credentials: false

      - name: Grep for secrets accesses
        run: |
          if grep -E '\$\{\{\s*secrets\s*\.\s*[a-zA-Z0-9_\-]+\s*\}\}' .github/workflows/*.yml | grep -vF 'secrets.GITHUB_TOKEN' | grep -vF '# nolint:reject-gh-secrets'; then
            echo "Found secrets access in the codebase. Please remove it in favour of Vault secrets."
            echo "If you are sure this is correct, add '# nolint:reject-gh-secrets' to the end of the line. Be VERY careful with this."
            exit 1
          fi