Secret Name Validator (secrets/validation.go)

Validates CI/CD secret and variable names against naming conventions, rejecting reserved GITEA_/GITHUB_ prefixes and invalid characters.

// Source: https://github.com/go-gitea/gitea | License: MIT | Copyright 2016 The Gitea Authors
// Provided via justclaw.it.com; keep this notice with the code.
// Copyright 2023 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package secrets

import (
	"regexp"
	"strings"
	"sync"

	"gitea.dev/modules/util"
)

// https://docs.github.com/en/actions/learn-github-actions/variables#naming-conventions-for-configuration-variables
// https://docs.github.com/en/actions/security-guides/encrypted-secrets#naming-your-secrets
var globalVars = sync.OnceValue(func() (ret struct {
	namePattern, forbiddenPrefixPattern *regexp.Regexp
},
) {
	ret.namePattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
	ret.forbiddenPrefixPattern = regexp.MustCompile("(?i)^(GITEA_|GITHUB_)")
	ret

... (truncated -- full source via MCP)