[deep-report] Add deterministic CI check for secrets leaking into job outputs (replace ad hoc proximity grep) #55133

Description

The Daily Secrets Analysis workflow (discussion #55123) currently checks for "secrets leaking into job outputs" via a coarse line-proximity grep (outputs: + secrets. within ~5 lines), which the report itself flags as producing false positives requiring manual spot-checking every run: "a small dedicated script that parses actual YAML outputs: maps (rather than line-proximity grep) would give a more authoritative answer and could be added as a permanent CI check."

Proposed Fix

Add a small, permanent validation script (e.g. under scripts/ or as a Go test in pkg/workflow) that parses compiled .lock.yml files' actual outputs: maps and asserts none reference secrets.* directly, replacing the ad hoc grep the daily workflow currently runs by hand each time.

Expected Impact

Turns a recurring manual/ambiguous check (currently re-verified by an LLM agent every day) into a deterministic, CI-enforced guarantee — catching a real secret-exposure class regression immediately instead of relying on a daily report noticing it.

Suggested Agent

New Agent / general-purpose — small standalone script or Go test, can reuse existing lock-file parsing utilities in pkg/workflow.

Estimated Effort

Medium (1-4 hours)

Data Source

DeepReport Intelligence analysis, discussion #55123 ([daily secrets] Daily Secrets Analysis — 2026-08-23), Recommendation 1 (first-ever run of this workflow).

Generated by 🔬 Deep Report · agent · 212.6 AIC · ⌖ 15.7 AIC · ⊞ 12.4K · ◷

• expires on Aug 25, 2026, 10:35 AM UTC-08:00