Fail CI when secrets are tracked

Fail if a tracked `.env` (other than `.env.example`) or a private key / token pattern is in git.

At a glance

Who: Teams that must never commit .env files or high-signal credentials.
What: Fail if a tracked .env (other than .env.example) or a private key / token pattern is in git.
Use when: As a CI hygiene step next to the artifact check.
Avoid when: As a substitute for a full secret scanner (GitHub secret scanning, gitleaks) on history.
See also: Fail CI when build artifacts are tracked, Keep .env complete without overwriting local values

pnpm add @zedtech/zedkit-quality

Latest: 1.1.0 (via changesets).

Usage

// package.json
{
  "scripts": {
    "check:secrets": "zedkit-check-no-secrets"
  }
}

Wraps: (none)