detect-secrets.yml

name: Detect secrets on Kedro

on:
  workflow_call:
    inputs:
      os:
        type: string
      python-version:
        type: string
      branch:
        type: string
        default: ''

jobs:
  detect-secrets:
    runs-on: ${{ inputs.os }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}
      - name: Set up Python ${{ inputs.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ inputs.python-version }}
      - name: Cache python packages
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ${{inputs.os}}-python-${{inputs.python-version}}
      - name: Install dependencies
        run: |
            make install-test-requirements
            make install-pre-commit
      - name: pip freeze
        run: uv pip freeze --system
      - name: Scan all tracked files
        run: git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline