feat(ci): add secret-scan workflow + reusable entry point for org-wide enrollment

[HongmingWang-Rabbit]

[Molecule-Platform-Evolvement-Manager]

Org-wide CI gate against credential leaks. Defense-in-depth for the #2090-class incident — audit log proved the leak source was GitHub's hosted Copilot Coding Agent (UA GitHub CLI 2.90.0 Agent/claude-code), not Molecule's CP-BE. That agent runs in GitHub infra outside our control and clones with the token embedded in the remote URL; npm init then slurps it into package.json. We can't fix upstream's clone hygiene — we gate at the PR layer.

Pairs with Molecule-AI/molecule-ai-workspace-runtime#55 which adds the same scan as a runtime-side pre-commit hook (catches commits made by our runtime; this PR catches commits made by GitHub-hosted agents that bypass our runtime).

Single workflow, dual purpose

Mode	Trigger	Effect
Self-gate	pull_request, push (main/staging), merge_group	Required check on this repo
Reusable	workflow_call	Other Molecule-AI repos enroll with 3 lines (see Rollout below)

Pattern set

Covers GitHub family (ghp_, ghs_, gho_, ghu_, ghr_, github_pat_), Anthropic, OpenAI, Slack, AWS. Mirror of the runtime's bundled pre-commit hook (molecule-ai-workspace-runtime: molecule_runtime/scripts/pre-commit-checks.sh). When either side adds a pattern, update both.

Anchored on prefixes with low false-positive rates against agent-generated content. No plain hex blobs (would false-positive on commit hashes / IDs).

Error message redacts the matched value

Prints <file> (matched: <pattern>) only — the secret value never lands in CI logs (logs are searchable + retained, so echoing widens the blast radius).

Self-exclude

.github/workflows/secret-scan.yml is on the SELF exclude list because the file's own regex literals would otherwise block its own merge.

Rollout plan (follow-up PRs, separate scope)

After this lands, enroll the high-traffic repos surfaced in the audit log (top 5 by Copilot Coding Agent activity over 7 days):

Rank	Repo	Agent events / 7d
1	molecule-core	1,781 — covered by this PR
2	docs	170
3	molecule-monorepo	169 (suspect orphan — investigate first)
4	molecule-controlplane	TBD (high-value: provisions tenants)
5	molecule-ai-workspace-runtime	TBD (publishes to PyPI — secret leak = supply chain risk)

Each enrollment PR is 3 lines:

name: Secret scan
on: [pull_request, push, merge_group]
jobs:
  scan:
    uses: Molecule-AI/molecule-monorepo/.github/workflows/secret-scan.yml@main

Plus a one-line branch-protection update to mark Scan diff for credential-shaped strings as required.

Test plan

• CI on this PR: the workflow self-runs and passes (no secret-shaped strings in the workflow file itself thanks to SELF exclude)
• Verify SELF exclude: the regex literals in the workflow file would otherwise match ghs_[A-Za-z0-9]{36,} against itself; if SELF didn't work the workflow would fail on its own merge
• Post-merge: open a follow-up enrollment PR for molecule-controlplane as the canary consumer to confirm workflow_call cross-repo invocation works
• Post-merge follow-up: confirm molecule-monorepo repo's 169 agent events are legitimate (not orphan) before enrolling

🤖 Generated with Claude Code