secrets-scanning-in-pipelines

把密钥和凭据在代码提交前和 CI 流程里就拦下来，避免意外把秘密写进仓库或构建产物里。平时开发、代码审核或改流水线时用，能在提交点和构建点两个关口阻断泄露。特点是预防为主，能把问题挡在共享分支和发布之前，降低事后清理成本。

## Purpose

Secrets leak into repos constantly — a key pasted for a quick test, a `.env` committed by accident. Once pushed, the credential is compromised even after you delete it, because history and mirrors keep the copy. This skill covers catching them at two chokepoints (before the commit, and in CI) so they never reach a shared branch.

It's the preventive counterpart to the OSINT github-secret-recon skill: that one finds leaks after the fact, this one stops them happening.

## When to use it

Setting up a new repo, or hardening an existing one that's had a leak scare. High value for low effort — a pre-commit hook plus a CI job blocks the overwhelming majority of accidental secret commi