WP1: Port Algorithm v3.7.0 and Fix USER Directory Structure

.github/workflows/ci.yml

@@ -62,17 +62,31 @@ jobs:
           # Search in common code directories
           SEARCH_DIRS="Tools .opencode skill-packs"
 
+          echo "🔍 Scanning for hardcoded secrets..."
           FOUND=0
           for dir in $SEARCH_DIRS; do
             if [ -d "$dir" ]; then
-              if grep -rEin "sk-[a-zA-Z0-9._-]{20,}|(api[_-]?key|client[_-]?secret|password|token)[[:space:]]*[:=][[:space:]]*['\"]?[a-zA-Z0-9._-]{20,}['\"]?" "$dir" --include="*.ts" --include="*.js" --include="*.json" 2>/dev/null; then
-                FOUND=1
+              echo "  Scanning $dir..."
+              # Find potential secrets (include YAML configs)
+              RESULT=$(grep -rEin "sk-[a-zA-Z0-9._-]{20,}|(api[_-]?key|client[_-]?secret|password|token)[[:space:]]*[:=][[:space:]]*['\"]?[a-zA-Z0-9._-]{20,}['\"]?" "$dir" --include="*.ts" --include="*.js" --include="*.json" --include="*.yaml" --include="*.yml" --exclude-dir="node_modules" 2>/dev/null | grep -v "BountyPrograms.json" || true)
+
+              if [ -n "$RESULT" ]; then
+                # Filter out process.env references (environment variable lookups, not hardcoded secrets)
+                FILTERED=$(echo "$RESULT" | grep -vi "process\.env" | grep -vi "\.env\.example" || true)
+
+                if [ -n "$FILTERED" ]; then
+                  # Only show file:line, not the content (to avoid exposing secrets in logs)
+                  echo "❌ Potential hardcoded secret found:"
+                  echo "$FILTERED" | cut -d: -f1,2
+                  FOUND=1
+                fi
               fi
             fi
           done
 
           if [ $FOUND -eq 1 ]; then
-            echo "❌ Potential hardcoded secret found!"
+            echo ""
+            echo "❌ Secret scan failed! Please remove hardcoded secrets or use environment variables."
             exit 1
           fi