gcloud iam service-accounts keys list \
  --iam-account=<sa>@<project>.iam.gserviceaccount.com
# Confirm whether your USER_MANAGED key from the secret is still listed.

gcloud iam service-accounts keys create /tmp/key.json \
  --iam-account=<sa>@<project>.iam.gserviceaccount.com
# Then upload the new key to wherever your workflow reads it (e.g. VERTEX_SA_KEY GitHub Secret), and delete the old USER_MANAGED key from GCP.
shred -u /tmp/key.json

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.
! [remote rejected]   main -> main (push declined due to repository rule violations)

permissions:
  contents: write
  pull-requests: write   # NOT just contents:write

# In the commit step:
DATE=$(date -u +%F)
BRANCH="chore/<topic>-$DATE-$(date -u +%H%M)"
git checkout -b "$BRANCH"
git commit -m "..."
git push --set-upstream origin "$BRANCH"
gh pr create \
  --label automation --label documentation --label auto-merge

# Wrong:
if git diff --quiet docs/conformance/; then
  exit 0
fi
git add docs/conformance/
git commit ...

# Right:
git add docs/conformance/ 2>/dev/null || true
if git diff --quiet --cached docs/conformance/; then
  exit 0
fi
git commit ...

'ascii' codec can't encode character '' in position N
'latin-1' codec can't encode character '' in position N

value="$(printf '%s' "$value" | sed $'1s/^\xEF\xBB\xBF//' | sed -E 's/[[:space:]]+$//')"

{
  id: 'admin-studio',
  stagingWorkerName: 'admin-studio-staging',
  stagingCustomDomain: 'admin-staging.latwoodtech.work',   // ← add this
  ...
}

# ❌ Vulnerable
- run: node scaffold.mjs "${{ inputs.app_name }}"

# ✅ Safe
- env:
    APP_NAME: ${{ inputs.app_name }}
  run: node scaffold.mjs "$APP_NAME"

const wranglerAddedLines = extractAddedLines(files.filter(f => /wrangler/.test(f.filename ?? '')));
if (/vars:\s*[\s\S]*?(?:KEY|SECRET|TOKEN|PASSWORD)\s*:/im.test(wranglerAddedLines))
  violations.push(...)