chore(CI): Add secret scan validation

.github/workflows/validate-cli.yaml

@@ -22,7 +22,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
-    name: Validate Cli
+    name: Validate CLI
 
     steps:
       - name: Checkout

.github/workflows/validate-secret-scan.yaml

@@ -0,0 +1,68 @@
+name: Validate Secret Scan
+
+on:
+  push:
+    branches:
+      - '!develop'
+      - '!main'
+    paths:
+      ['packages/secret-scan/**', '.github/workflows/validate-secret-scan.yml']
+  pull_request:
+    paths:
+      ['packages/secret-scan/**', '.github/workflows/validate-secret-scan.yml']
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    name: Validate Secret Scan
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.2.0
+          run_install: false
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - uses: actions/cache@v4
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install packages
+        run: |
+          pnpm i
+
+      - name: Lint
+        run: |
+          pnpm run lint:secret-scan
+
+      - name: Build
+        run: |
+          pnpm run build:secret-scan
+
+      - name: Test
+        run: |
+          pnpm run test:secret-scan
+
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v3
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          flags: secret-scan

package.json

@@ -105,6 +105,7 @@
     "lint:platform": "turbo run lint --filter=platform",
     "lint:cli": "turbo run lint --filter=cli",
     "lint:api-client": "turbo run lint --filter=api-client",
+    "lint:secret-scan": "turbo run lint --filter=secret-scan",
     "lint:schema": "turbo run lint --filter=schema",
     "build": "turbo run build",
     "build:api": "pnpm db:generate-types && turbo run build --filter=api",