[ngjaying]

Summary

• Add a read-only Gitleaks workflow for pull requests, pushes to master, and manual runs.
• Scan the checked-out source and every commit introduced by a PR.
• Pin Gitleaks 8.30.0 and verify the release archive against its SHA-256 digest.

Why

Source scanning catches credentials present in the proposed code. Scanning the PR commit range also catches credentials added and subsequently removed before review. Scanning only this range avoids repeatedly blocking changes on older findings in the base branch history.

Changes In This PR

• Add .github/workflows/gitleaks.yaml with a pinned checkout action, full commit history, read-only permissions, and disabled persisted checkout credentials.
• Install a fixed Gitleaks release without executing project code or requiring repository secrets.
• Scan current source on each trigger and base.sha..head.sha on pull requests, with fully redacted output and no inline or fingerprint suppressions.
• Keep the PR commit scan running even if the current-source scan finds a problem.

Notes

#4208 has merged, and this branch has been rebased onto the updated master. Both current-source and PR-commit scans pass locally without temporary exclusions.

Validation: actionlint passed; the actual download, checksum verification, extraction, and version check passed. The cleaned source from #4208 plus this workflow scans with zero findings. An isolated repository containing a freshly generated disposable private key added and removed in successive commits passed current-source scanning but was correctly rejected by PR-range scanning. git diff --check passed.

Making this job a required merge check is a separate repository ruleset setting; this PR does not modify repository settings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.03%. Comparing base (3cff1c2) to head (0bcd41d).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4209      +/-   ##
==========================================
+ Coverage   73.00%   73.03%   +0.03%     
==========================================
  Files         490      490              
  Lines       59030    59030              
==========================================
+ Hits        43091    43110      +19     
+ Misses      12820    12808      -12     
+ Partials     3119     3112       -7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.