Initialize project infrastructure, add tests, and update dependencies

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: Report a bug in SecretLens
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting! For security vulnerabilities, please use
+        [private reporting](https://github.com/nobuo-miura/SecretLens/security/advisories/new) instead.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the bug, including the command you ran and the output.
+      placeholder: |
+        Command: secretlens scan --source=docker --image=...
+        Expected: ...
+        Actual: ...
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to reproduce. If a specific file/pattern triggers it, include a redacted sample (never paste real secrets).
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: SecretLens version
+      placeholder: e.g. v0.1.0 or commit hash
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: e.g. macOS 15 / Go 1.26 / arm64

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/nobuo-miura/SecretLens/security/advisories/new
+    about: Please report security vulnerabilities privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest a new feature or detection rule
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the use case or gap this feature addresses.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How should it work? For new detection rules, describe the secret format (with a fake example) and suggested severity.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## Summary
+
+<!-- What does this PR change and why? -->
+
+## Changes
+
+-
+
+## Checklist
+
+- [ ] `go test ./...` passes
+- [ ] `golangci-lint run` reports no new warnings
+- [ ] Tests added/updated for behavior changes
+- [ ] Test fixtures use clearly fake secrets (no real credentials)

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: go test ./...
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.golangci.yml

@@ -0,0 +1,27 @@
+version: "2"
+
+linters:
+  default: standard
+  enable:
+    - misspell
+    - unconvert
+    - unparam
+    - gocritic
+    - revive
+  settings:
+    revive:
+      rules:
+        - name: exported
+          disabled: true
+  exclusions:
+    rules:
+      # テストコードでは緩めに
+      - path: _test\.go
+        linters:
+          - unparam
+          - gocritic
+
+formatters:
+  enable:
+    - gofmt
+    - goimports

.goreleaser.yml

@@ -0,0 +1,49 @@
+version: 2
+
+project_name: secretlens
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - id: secretlens
+    main: ./cmd/secretlens
+    binary: secretlens
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
+    ldflags:
+      - -s -w
+
+archives:
+  - formats: [tar.gz]
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
+
+checksum:
+  name_template: checksums.txt
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^ci:"
+
+release:
+  draft: false
+  prerelease: auto

CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing to SecretLens
+
+Thank you for your interest in contributing! Contributions of all kinds are welcome: bug reports, detection rules, documentation, and code.
+
+## Getting Started
+
+```bash
+git clone https://github.com/nobuo-miura/SecretLens.git
+cd SecretLens
+make build   # builds bin/secretlens
+go test ./...
+```
+
+Requirements:
+
+- Go (version pinned in `go.mod`)
+- `golangci-lint` for linting (`make lint` if available, or `golangci-lint run`)
+
+## Development Workflow
+
+1. Fork the repository and create a branch from `main`.
+2. Make your changes. Please:
+   - Run `gofmt` (or rely on your editor's Go tooling).
+   - Run `golangci-lint run` and fix any new warnings.
+   - Add or update tests for behavior changes.
+3. Run the full test suite: `go test ./...`
+4. Open a pull request against `main` with a clear description of the change and its motivation.
+
+## Adding Detection Rules
+
+Built-in rules live in [rules/](rules/). When adding a rule:
+
+- Include realistic **positive** and **negative** test fixtures (use clearly fake secrets, e.g. `AKIAIOSFODNN7EXAMPLE`-style placeholders — never real credentials).
+- Keep regexes anchored and specific enough to avoid noisy false positives.
+- Set an appropriate severity.
+
+## Reporting Bugs / Requesting Features
+
+Use the issue templates. For **security vulnerabilities**, follow [SECURITY.md](SECURITY.md) instead of opening a public issue.
+
+## Commit Messages
+
+Write commit messages in English, in imperative mood (e.g. `Add Slack webhook rule`, `Fix entropy threshold off-by-one`).
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE.md).

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release of SecretLens receives security updates.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Instead, report them privately via [GitHub Security Advisories](https://github.com/nobuo-miura/SecretLens/security/advisories/new).
+
+You can expect an initial response within 7 days. Once the issue is confirmed and fixed, we will publish an advisory and credit the reporter (unless you prefer to remain anonymous).
+
+## Scope
+
+SecretLens is a secret *detection* tool. False negatives (secrets it fails to detect) are quality issues, not vulnerabilities — please report those as regular issues. Security reports should cover things like:
+
+- SecretLens itself leaking scanned secrets (e.g. to logs, telemetry, or network)
+- Code execution or path traversal triggered by scanned content
+- Vulnerabilities in the verification (`--verify`) network calls

cmd/secretlens/scan.go

@@ -309,18 +309,23 @@ func scanCILog(ctx context.Context, rules []regex.Rule) ([]finding.Finding, erro
 	var scanErr error
 	go func() {
 		defer close(ch)
-		if flagRepo != "" {
+		switch {
+		case flagRepo != "":
 			parts := strings.SplitN(flagRepo, "/", 2)
 			if len(parts) != 2 {
 				scanErr = fmt.Errorf("--repo は owner/repo 形式で指定してください")
 				return
 			}
-			s := cilog.NewGitHubActionsScanner(token, parts[0], parts[1])
+			s, err := cilog.NewGitHubActionsScanner(token, parts[0], parts[1])
+			if err != nil {
+				scanErr = err
+				return
+			}
 			scanErr = s.StreamLogs(ctx, ch)
-		} else if flagProjectID != "" {
+		case flagProjectID != "":
 			s := cilog.NewGitLabCIScanner(flagGitLabURL, token, flagProjectID)
 			scanErr = s.StreamLogs(ctx, ch)
-		} else {
+		default:
 			scanErr = fmt.Errorf("cilogスキャンには --repo (GitHub) または --project-id (GitLab) が必要です")
 		}
 	}()
@@ -366,7 +371,10 @@ func outputFindings(ctx context.Context, findings []finding.Finding, repoPath st
 		if len(parts) != 2 {
 			return fmt.Errorf("--repo は owner/repo 形式で指定してください")
 		}
-		r := reportgithub.New(token, parts[0], parts[1])
+		r, err := reportgithub.New(token, parts[0], parts[1])
+		if err != nil {
+			return err
+		}
 		if flagGitHubPR > 0 {
 			if err := r.PostPRComment(ctx, flagGitHubPR, findings); err != nil {
 				return err

go.mod

@@ -1,10 +1,10 @@
 module github.com/nobuo-miura/SecretLens
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/bmatcuk/doublestar/v4 v4.10.0
-	github.com/google/go-github/v72 v72.0.0
+	github.com/google/go-github/v89 v89.0.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/oauth2 v0.36.0
@@ -13,7 +13,7 @@ require (
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect

go.sum

@@ -3,13 +3,13 @@ github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fT
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v72 v72.0.0 h1:FcIO37BLoVPBO9igQQ6tStsv2asG4IPcYFi655PPvBM=
-github.com/google/go-github/v72 v72.0.0/go.mod h1:WWtw8GMRiL62mvIquf1kO3onRHeWWKmK01qdCY8c5fg=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -25,7 +25,6 @@ github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=