Stabilize staff concurrency and premium emoji; enable verified Drone deployment

scripts/check_secrets.py

@@ -0,0 +1,36 @@
+"""Scan tracked content without printing matched credentials."""
+from pathlib import Path
+import re
+import subprocess
+
+RULES = {
+    "telegram-token": re.compile(r"\b\d{6,12}:[A-Za-z0-9_-]{32,}\b"),
+    "private-key": re.compile(r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----"),
+}
+
+
+def main():
+    files = subprocess.check_output(["git", "ls-files", "-z"]).decode("utf-8").split("\0")
+    violations = []
+    for name in filter(None, files):
+        path = Path(name)
+        if not path.is_file():
+            continue
+        if path.name.startswith(".env") and not path.name.endswith(".example"):
+            violations.append(f"{name}: tracked runtime environment")
+        if ".history" in path.parts:
+            violations.append(f"{name}: tracked editor history")
+        text = path.read_text(encoding="utf-8", errors="replace")
+        for rule, pattern in RULES.items():
+            for match in pattern.finditer(text):
+                line = text.count("\n", 0, match.start()) + 1
+                violations.append(f"{name}:{line}: {rule}")
+    for violation in violations:
+        print(violation)
+    if violations:
+        raise SystemExit(1)
+    print("Tracked secret scan passed")
+
+
+if __name__ == "__main__":
+    main()