feat: config-ready trio composite actions (typos, editorconfig, gitleaks)

[kyle-sexton]

Phase 1 of the CI de-duplication program: lift the three lanes whose tool config already lives in standards (modules/typos, modules/editorconfig, modules/gitleaks) into ci-workflows as granular composite actions. Only the execution action was missing, so there is no config work — both standards and medley can now reference these instead of carrying inline copies.

What's here

Three composite actions under .github/actions/, each following the repo's established single-binary idiom (curl + SHA-256 checksum-pin, like shellcheck/lychee-offline): self-contained, no nested third-party action, composite gotchas handled (shell: on every step, no post:, inputs passed via env).

Action	Version	Checksum corroboration
typos	v1.47.2	computed + taiki-e install-action manifest
editorconfig	v3.7.0 (standards was v3.6.1)	computed + upstream checksums.txt
gitleaks	v8.30.1	computed + standards' recorded hash

• Open-closed inputs (D4) with behavior-preserving defaults: paths/path, config, exclude, version, sha256.
• Backfill beyond standards' inline behavior, all optional + default-off: typos --format (incl. sarif), editorconfig --format github-actions, gitleaks --report-format/--report-path (SARIF emit; the SARIF upload stays a caller-side job concern per D1/D7 — documented in the action and research note).
• Research notes under docs/dedup-program/research/ (version + invocation verified against the GitHub releases API and corroborated; nothing relied on from training data).

Dogfood

Wired into ci.yml behind the local ci-status gateway, with the matching configs vendored byte-identical from standards (sha256-confirmed, LF preserved). All three verified locally against the tracked tree before push (typos/editorconfig/gitleaks clean; the gitleaks default ruleset does not trip on the action checksums).

Also

• Ticks Phase 0 D6 (Actions access confirmed access_level: organization) and the three Phase 1 action checkboxes in plan.md.
• Separate commit resyncs .gitignore with standards (a pre-existing vendoring-lockstep drift; header comment only, no rule change).

Adoption in standards (retiring its inline typos/editorconfig/gitleaks lanes, pinned to this PR's squash SHA) follows as a separate PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b0a0b3776

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Extract editorconfig into a temp dir

Composite action steps run in the caller's workspace, so in any consuming repo that has a top-level bin/ directory this cleanup removes the repo's own files after extracting bin/ec-linux-amd64. That can make later steps in the job fail or hide files from checks; extract the archive under $RUNNER_TEMP or another unique directory instead of deleting bin from the workspace.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add --force-exclude for explicit paths

When callers use the supported paths input as an explicit file list, typos does not apply configured or CLI excludes to those paths unless --force-exclude is set; the v1.47.2 help text says that flag is required to “Respect excluded files even for paths passed explicitly.” A pre-commit-style caller passing changed files can therefore still fail on files covered by exclude or [files].extend-exclude (for example minified/generated files), contrary to this action's exclude contract.

Useful? React with 👍 / 👎.