ci: add secret-scan (gitleaks) job for push-protection compliance

[don-petry]

Summary

• Adds the required secret-scan job to .github/workflows/ci.yml per Layer 3 of the push-protection standard
• Full-history checkout (fetch-depth: 0) — scans all commits, not just the PR diff
• --redact so leaked values are never written to workflow logs
• --exit-code 1 so the build fails on any finding
• Both actions pinned to commit SHAs per Action Pinning Policy

This satisfies the secret_scan_ci_job_present (error severity) compliance check.

What still requires human admin action

The security_and_analysis_unavailable warning persists because the compliance audit token lacks admin scope to read security_and_analysis settings. A repo/org admin needs to:

1. Ensure the audit token has the admin:repo_hook / admin scope on this repo
2. Verify these settings are enabled in GitHub Settings → Code security:
   • Secret scanning: enabled
   • Secret scanning push protection: enabled
   • Secret scanning AI detection: enabled (may require plan upgrade)
   • Secret scanning non-provider patterns: enabled (may require plan upgrade)
   • Dependabot security updates: enabled

Test plan

• CI runs secret-scan job on this PR
• gitleaks scans full history, finds no secrets
• Job passes (green)
• Weekly compliance audit shows secret_scan_ci_job_present resolved

Closes #95

Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@github-actions[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 58 minutes and 42 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b4601184-b2c4-496b-86d4-3b07bec46c3a

📥 Commits

Reviewing files that changed from the base of the PR and between 0c85a39 and b35d7e6.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .gitleaks.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-95-20260419-1649

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

CODEOWNERS review requested. @don-petry — this PR adds the gitleaks job to satisfy the compliance check. Please review and merge when CI is green.

[Copilot]

Pull request overview

Adds a CI-layer secret scanning job to support push-protection compliance by running gitleaks in the main CI workflow.

Changes:

• Adds a new secret-scan job to .github/workflows/ci.yml.
• Uses full-history checkout (fetch-depth: 0) and runs gitleaks detect with --redact and --exit-code 1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment references ci-standards.md#action-pinning-policy, but there’s no ci-standards.md (or section anchor) in this repo, so this guidance is currently a dead link. Please update the reference to the actual document/location where action pinning is defined (or remove the reference if it’s not documented here).

Suggested change

	# Pin to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	fetch-depth: 0
	- name: Run gitleaks
	# Pinned to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Pin to a commit SHA rather than a mutable tag.
	# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	fetch-depth: 0
	- name: Run gitleaks
	# Pin to a commit SHA rather than a mutable tag.

[Copilot]

This comment also points to ci-standards.md#action-pinning-policy, which doesn’t exist in this repository. Update it to the correct in-repo documentation location so future maintainers can follow the pin-refresh instructions.

Suggested change

	# Pin to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	fetch-depth: 0
	- name: Run gitleaks
	# Pinned to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Pin to SHA per Action Pinning Policy (coding-standards.md#action-pinning-policy).
	# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	fetch-depth: 0
	- name: Run gitleaks
	# Pinned to SHA per Action Pinning Policy (coding-standards.md#action-pinning-policy).

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[don-petry]

CI fix: replaced gitleaks/gitleaks-action with direct CLI install

The Secret scan (gitleaks) job was failing with:

[petry-projects] is an organization. License key is required.

gitleaks/gitleaks-action requires a paid license for GitHub org repos. This commit replaces it with a direct CLI install approach that:

• Downloads gitleaks v8.30.1 binary via wget
• Verifies the download with sha256sum
• Runs gitleaks detect directly (no license needed)

Also removed the now-unnecessary security-events: write permission from the job.

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[don-petry]

@dev-lead - please fix this PR

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.