ci: add gitleaks secret-scan job to ci.yml

[don-petry]

Summary

• Adds the required secret-scan job to .github/workflows/ci.yml per push-protection.md#required-ci-job
• Uses gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 (v2.3.9, SHA verified by dereferencing the v2 annotated tag)
• fetch-depth: 0 scans full git history, not just the PR diff
• --redact prevents secrets from appearing in workflow logs
• --exit-code 1 fails the build on any finding
• Both actions SHA-pinned per the Action Pinning Policy

Note: PRs #128 and #138 (from prior Claude runs) are still open but were not merged — this PR addresses the same compliance finding from the current branch.

Closes #112

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Enhanced repository security scanning in the CI pipeline to detect sensitive information.

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 5 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aa7d5af6-a356-40f5-b56f-521ceadd7890

📥 Commits

Reviewing files that changed from the base of the PR and between b0fd5ed and 23ef5ac.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .gitleaksignore

📝 Walkthrough

Walkthrough

Added a secret-scan CI job to detect secrets using gitleaks/gitleaks-action. The job checks the full repository history, executes gitleaks detect, and validates that no secrets are committed. Existing CI jobs remain unchanged.

Changes

Cohort / File(s)	Summary
CI Configuration .github/workflows/ci.yml	Added new secret-scan job that runs gitleaks to detect and redact secrets, with full git history checkout and exit code handling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related issues

• The linked issue #112 is directly addressed by this PR as the primary objective. The possibly related issues shown are from other repositories and are not in scope for this change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding a gitleaks secret-scan job to the CI workflow file.
Linked Issues check	✅ Passed	The PR successfully implements the required gitleaks secret-scan job to meet push-protection compliance [#112], with proper SHA pinning and configuration per standards.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing the secret-scan job requirement from issue #112; no unrelated modifications are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-112-20260420-0132

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — you are CODEOWNER for /.github/. This PR adds the required secret-scan job per the compliance finding in #112.

Self-review:

• Job name, permissions, and structure match push-protection.md#required-ci-job verbatim
• actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2) — same SHA already in use by all other jobs in this file
• gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 (v2.3.9) — SHA verified by dereferencing the v2 annotated tag via gh api repos/gitleaks/gitleaks-action/git/refs/tags/v2
• fetch-depth: 0, --redact, --exit-code 1 all present as required

Note: PRs #128 and #138 (prior Claude attempts) are still open — please close those once this one is merged.

[Copilot]

Pull request overview

Adds a required secret-scanning job to the main CI workflow to satisfy the push-protection compliance finding (#112) by running gitleaks on pushes and pull requests.

Changes:

• Introduces a new secret-scan CI job that runs gitleaks/gitleaks-action and fails the workflow on findings.
• Checks out full git history (fetch-depth: 0) to scan beyond the PR diff, with redaction enabled to avoid leaking secrets in logs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 172-185: The gitleaks step is using uses: gitleaks/gitleaks-action
with a with.args entry (args: detect --source . --redact --verbose --exit-code
1) that the pinned action does not support, so those flags are ignored and
full-history scan is not honored; replace that step with a pinned gitleaks CLI
invocation or an action variant that explicitly accepts custom args (or run the
gitleaks binary via docker/runner) and invoke the exact command "gitleaks detect
--source . --redact --verbose --exit-code 1" (keeping the checkout fetch-depth:
0) and pin the chosen CLI/image to a SHA so the workflow actually runs the
supplied flags instead of the hardcoded command used by
gitleaks/gitleaks-action.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8fd443a0-67b8-421c-a9e7-e1e407ae7122

📥 Commits

Reviewing files that changed from the base of the PR and between 9a6419e and b0fd5ed.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

[don-petry]

CI is now green ✓ All jobs pass:

• TypeScript: success
• Go: success
• Secret scan (gitleaks): success

What was needed beyond the standard template:

1. gitleaks/gitleaks-action v2+ requires a GITLEAKS_LICENSE secret for org accounts — added continue-on-error: true and a gitleaks binary fallback step to enforce scanning without the license
2. Added .gitleaksignore to suppress 7 false-positive generic-api-key findings — all SHA-256 content hashes in _bmad/_config/files-manifest.csv and example test code in _bmad/tea/testarch/knowledge/api-testing-patterns.md (commit ac7e03d)

This PR is ready to merge. Merging will close issue #112 and should prevent the weekly compliance audit from re-opening it. Please also close the stale PRs #128 and #138 once this is merged.

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude finished @don-petry's task in 1m 38s —— View job

---

Addressing Review Comments

• Gather context and read current workflow file
• Analyze CodeRabbit's finding: with.args not supported
• Analyze Copilot's finding: version tag mismatch in checkout pin comment
• Implement fix (blocked — see below)

---

CodeRabbit Finding — Already Resolved

CodeRabbit's review was on an earlier commit (b0fd5ede). In the current code, the gitleaks/gitleaks-action step at line 187 no longer uses with.args at all. The enforcement is handled entirely by the separate binary step (lines 193–210), which explicitly runs:

./gitleaks git --redact --exit-code 1 ...

This correctly honors fetch-depth: 0 (full history) and all required flags. CodeRabbit's concern is already addressed.

---

Copilot Finding — Still Present

Line 174 has a version tag mismatch in the lookup command comment:

# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

The comment says v4 but the pin is v6.0.2. The correct lookup command should reference v6.0.2:

# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'

---

Blocker: Cannot Modify Workflow Files

I'm unable to push this fix because GitHub App permissions do not allow modifications to .github/workflows/ files. You can find more information in the FAQ.

To apply the one-line fix manually:

sed -i 's|refs/tags/v4 --jq|refs/tags/v6.0.2 --jq|' .github/workflows/ci.yml
git add .github/workflows/ci.yml
git commit -m "ci: fix checkout pin lookup tag from v4 to v6.0.2 in secret-scan comment"
git push

This is the only outstanding issue. Once that comment is corrected, both review findings are fully addressed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

@dev-lead - please fix this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.