CI secret gate

The GitHub App can fail a pull request when a key is committed. You can also fail CI on the checkout itself.

1. Copy scripts/ci-secret-gate.mjs into your repo.
2. Copy .github/workflows/invince-secret-gate.example.yml into .github/workflows/.
3. Locally, npm run security:gate is the same scan.
4. git config core.hooksPath .githooks runs it before each commit.

That scan stays on GitHub’s runner (or your machine). It does not send the secret to Invince as a stored value.