infra: detect-secrets baseline + CI Debug/Release matrix

.github/workflows/ci.yml

@@ -19,10 +19,24 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  detect-secrets:
+    name: Detect Secrets
+    runs-on: ubuntu-latest
+    needs: secrets
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check secrets baseline
+        shell: bash
+        run: pip install --quiet detect-secrets && detect-secrets scan --baseline .secrets.baseline
+
   build:
-    name: Build & Format
+    name: Build & Format (${{ matrix.configuration }})
     runs-on: windows-latest
-    needs: secrets
+    needs: detect-secrets
+    strategy:
+      matrix:
+        configuration: [Debug, Release]
 
     steps:
       - uses: actions/checkout@v4
@@ -38,10 +52,10 @@ jobs:
         run: dotnet restore
 
       - name: Build
-        run: dotnet build --no-restore -c Release
+        run: dotnet build --no-restore -c ${{ matrix.configuration }}
 
       - name: Format check
         run: dotnet format --verify-no-changes --severity warn
 
       - name: Test
-        run: dotnet test --no-build -c Release --logger "console;verbosity=normal"
+        run: dotnet test --no-build -c ${{ matrix.configuration }} --logger "console;verbosity=normal"

.pre-commit-config.yaml

@@ -4,6 +4,12 @@ repos:
     hooks:
       - id: gitleaks
 
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: ["--baseline", ".secrets.baseline"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.6.0
     hooks:

.secrets.baseline

@@ -0,0 +1,127 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    }
+  ],
+  "results": {},
+  "generated_at": "2026-05-19T09:10:31Z"
+}

README.md

@@ -90,6 +90,7 @@ Hooks run automatically on `git commit`:
 | Hook | Purpose |
 |---|---|
 | **gitleaks** | Detects secrets and credentials before they enter history |
+| **detect-secrets** | Validates no new secrets against `.secrets.baseline` |
 | **dotnet format** | Enforces `.editorconfig` conventions |
 | **trailing-whitespace** | Strips trailing whitespace |
 | **end-of-file-fixer** | Ensures files end with a newline |
@@ -108,6 +109,8 @@ Hooks run automatically on `git commit`:
 | 6 | ⬜ Planned | Add optional XOR/RC4 shellcode decryption stage |
 | 7 | ✅ Done | CI workflow (GitHub Actions) — secret scan + build + format check on push |
 | 8 | ✅ Done | xUnit test project — CLI argument validation and URL guard (Win32 calls are integration-level and excluded) |
+| 9 | ✅ Done | detect-secrets baseline (`.secrets.baseline`) + pre-commit hook + CI step |
+| 10 | ✅ Done | CI matrix build for both Debug and Release configurations |
 
 ---