Guard against committed credentials: ignore secret files, secret scan in CI

.github/workflows/ci.yml

@@ -15,6 +15,11 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           python-version: ${{ matrix.python }}
+      - name: Secret scan (no cloud keys or private keys in the repository)
+        run: |
+          if git grep -nIE '(AKIA|ASIA)[A-Z0-9]{16}|aws_secret_access_key *=|BEGIN [A-Z ]*PRIVATE KEY'; then
+            echo "::error::credential-like content found"; exit 1
+          fi
       - name: Install
         # setup-uv >= 5.x already creates and activates .venv when python-version is set; --clear works either way
         run: uv venv --clear && uv pip install -e ".[dev]"

.gitignore

@@ -20,3 +20,13 @@ target/
 results/
 # editor lock files
 .~lock.*#
+# credentials and secrets (never commit)
+.aws/
+.env
+.env.*
+*.pem
+*.key
+*.p12
+credentials
+.git-credentials
+.netrc