feat(gitleaks): add gitleaks secret-scanning module

[kyle-sexton]

Adds a referenceable gitleaks secret-scanning module, a vertical slice mirroring the typos/markdown/editorconfig modules.

Contents

• modules/gitleaks/.gitleaks.toml — decoupled base: inherits the upstream default ruleset ([extend] useDefault = true), no repo specifics. Adopters layer their own [[allowlists]].
• modules/gitleaks/gitleaks.test.sh — shell-harness test (good fixture exit 0, bad fixture exit 1, asserts a finding).
• modules/gitleaks/README.md — engine, the three ignore mechanisms, adopt-in-a-repo guidance.
• fixtures/gitleaks/{good,bad} — good plants a token silenced with the native gitleaks:allow pragma; bad carries fabricated ghp_/glpat- tokens gitleaks flags.
• .github/workflows/gitleaks.yml — installs the gitleaks binary pinned by version + SHA256, scans the repo, runs fixtures.

Keeping the published config adopter-clean

The bad fixtures carry fabricated (non-real) tokens. Two repo-local files (not part of modules/gitleaks/) handle them so the shared config stays clean:

• .gitleaksignore lists the bad-fixture finding fingerprints, so the whole-repo dogfood scan passes.
• .gitguardian.yaml excludes fixtures/gitleaks/** from the GitGuardian PR check.

CI install note

gitleaks-action requires an org license and taiki-e/install-action has no gitleaks manifest, so CI installs the release tarball pinned by version + SHA256 (551f6fc…).

Validation (local, all green)

good exit 0 · bad exit 1 · whole-repo self-scan exit 0 · full shell harness 6/6 · shellcheck -x + actionlint clean · markdown + editorconfig + typos self-lint clean.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e40d57f7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scan the git history, not just the checkout

In the gitleaks workflow I checked the official CLI docs: git scans local repos via git log -p, while dir scans directories/files. Because this step uses dir against only the final checkout, a branch or PR that commits a token and removes it in a later commit will pass even though the secret remains in the pushed git history. For a CI secret-scanning gate, use a history scan and fetch the relevant commit range so deleted-but-committed secrets are caught.

Useful? React with 👍 / 👎.