From 6f72139e6b14ef68cd0f101a82e4a0e616bb2879 Mon Sep 17 00:00:00 2001
From: lucarlig <luca.carlig@ibm.com>
Date: Tue, 11 Aug 2026 12:23:42 +0100
Subject: [PATCH 1/2] ci: enforce detect-secrets baseline

Signed-off-by: lucarlig <luca.carlig@ibm.com>
---
 .github/workflows/ci.yml | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed231e77..02c2fcbb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,46 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo fmt --all --check
 
+  detect-secrets:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6.0.2
+      - name: Check detect-secrets configuration
+        id: detect_secrets_config
+        shell: bash
+        run: |
+          hook_pattern='^[[:space:]]*-[[:space:]]+id:[[:space:]]+detect-secrets([[:space:]]|$)'
+          hook_configured=false
+          if [[ -f .pre-commit-config.yaml ]] && grep -Eq "${hook_pattern}" .pre-commit-config.yaml; then
+            hook_configured=true
+          fi
+
+          if [[ "${hook_configured}" == true && -f .secrets.baseline ]]; then
+            echo "configured=true" >> "${GITHUB_OUTPUT}"
+          elif [[ "${hook_configured}" == false && ! -e .secrets.baseline ]]; then
+            echo "configured=false" >> "${GITHUB_OUTPUT}"
+            echo "::notice::detect-secrets enforcement will start when its hook and baseline are added"
+          else
+            echo "::error::the detect-secrets hook and .secrets.baseline must be added together"
+            exit 1
+          fi
+      - name: Install pre-commit
+        if: steps.detect_secrets_config.outputs.configured == 'true'
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+        run: |
+          python3 -m venv "${RUNNER_TEMP}/pre-commit-venv"
+          "${RUNNER_TEMP}/pre-commit-venv/bin/python" -m pip install pre-commit==4.6.0
+      - name: Run detect-secrets
+        if: steps.detect_secrets_config.outputs.configured == 'true'
+        env:
+          PRE_COMMIT_HOME: ${{ runner.temp }}/pre-commit-home
+        run: |
+          "${RUNNER_TEMP}/pre-commit-venv/bin/pre-commit" run detect-secrets \
+            --all-files \
+            --show-diff-on-failure
+
   clippy:
     runs-on: ubuntu-latest
     steps:

From 1a1bf6e04219c87b2abf2fe5b2426a9edde0b254 Mon Sep 17 00:00:00 2001
From: lucarlig <luca.carlig@ibm.com>
Date: Tue, 11 Aug 2026 12:41:43 +0100
Subject: [PATCH 2/2] ci: run detect-secrets directly

Signed-off-by: lucarlig <luca.carlig@ibm.com>
---
 .github/workflows/ci.yml     | 34 +---------------------------------
 scripts/ci/detect-secrets.sh | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 33 deletions(-)
 create mode 100755 scripts/ci/detect-secrets.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02c2fcbb..ee0d3425 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,40 +29,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6.0.2
-      - name: Check detect-secrets configuration
-        id: detect_secrets_config
-        shell: bash
-        run: |
-          hook_pattern='^[[:space:]]*-[[:space:]]+id:[[:space:]]+detect-secrets([[:space:]]|$)'
-          hook_configured=false
-          if [[ -f .pre-commit-config.yaml ]] && grep -Eq "${hook_pattern}" .pre-commit-config.yaml; then
-            hook_configured=true
-          fi
-
-          if [[ "${hook_configured}" == true && -f .secrets.baseline ]]; then
-            echo "configured=true" >> "${GITHUB_OUTPUT}"
-          elif [[ "${hook_configured}" == false && ! -e .secrets.baseline ]]; then
-            echo "configured=false" >> "${GITHUB_OUTPUT}"
-            echo "::notice::detect-secrets enforcement will start when its hook and baseline are added"
-          else
-            echo "::error::the detect-secrets hook and .secrets.baseline must be added together"
-            exit 1
-          fi
-      - name: Install pre-commit
-        if: steps.detect_secrets_config.outputs.configured == 'true'
-        env:
-          PIP_DISABLE_PIP_VERSION_CHECK: "1"
-        run: |
-          python3 -m venv "${RUNNER_TEMP}/pre-commit-venv"
-          "${RUNNER_TEMP}/pre-commit-venv/bin/python" -m pip install pre-commit==4.6.0
       - name: Run detect-secrets
-        if: steps.detect_secrets_config.outputs.configured == 'true'
-        env:
-          PRE_COMMIT_HOME: ${{ runner.temp }}/pre-commit-home
-        run: |
-          "${RUNNER_TEMP}/pre-commit-venv/bin/pre-commit" run detect-secrets \
-            --all-files \
-            --show-diff-on-failure
+        run: scripts/ci/detect-secrets.sh
 
   clippy:
     runs-on: ubuntu-latest
diff --git a/scripts/ci/detect-secrets.sh b/scripts/ci/detect-secrets.sh
new file mode 100755
index 00000000..118cc602
--- /dev/null
+++ b/scripts/ci/detect-secrets.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly BASELINE="${DETECT_SECRETS_BASELINE:-.secrets.baseline}"
+readonly DETECT_SECRETS_SPEC="${DETECT_SECRETS_SPEC:-git+https://github.com/ibm/detect-secrets.git@076672a9a01abdfc7ecee2e7d14f08cdccb73976}"
+readonly TEMP_ROOT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+readonly VENV="${DETECT_SECRETS_VENV:-${TEMP_ROOT}/detect-secrets-venv}"
+
+if [[ ! -f "${BASELINE}" ]]; then
+    if [[ "${GITHUB_ACTIONS:-false}" == "true" ]]; then
+        echo "::notice::detect-secrets enforcement will start when ${BASELINE} is added"
+    else
+        echo "detect-secrets: ${BASELINE} not found; skipping"
+    fi
+    exit 0
+fi
+
+python3 -m venv "${VENV}"
+PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    "${VENV}/bin/python" -m pip install --quiet "${DETECT_SECRETS_SPEC}"
+
+git ls-files -z | xargs -0 \
+    "${VENV}/bin/detect-secrets-hook" \
+    --baseline "${BASELINE}" \
+    --use-all-plugins \
+    --fail-on-unaudited \
+    --