"""# .github/workflows/secret-firewall.yml
name: Secret Firewall

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Scan diff for secrets
        id: scan
        run: |
          # Get diff
          DIFF=$(git diff origin/main...HEAD)

          # Check for Copilot-authored commits
          COPILOT_COMMITS=$(git log origin/main..HEAD --grep='Co-authored-with: GitHub Copilot' --oneline)
          if [ -n "$COPILOT_COMMITS" ]; then
            echo "Copilot-authored commits detected. Extra scrutiny."
          fi

          # Scan with gitleaks
          echo "$DIFF" | gitleaks detect --stdin --report-path=report.json

          if [ -s report.json ]; then
            echo "Secrets detected!"
            cat report.json
            exit 1
          fi

      - name: Alert on detection
        if: failure()
        uses: actions/github-script@v6
        with:
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
              body: '🚨 **Secret detected in PR!**\n\nPlease remove the secret and rotate if needed.\n\nSee Action logs for details.'
            });
"""