ci: add gitleaks secret-scan job (gitleaks-action v2.3.9)

[don-petry]

Summary

• Adds the required secret-scan job to ci.yml using gitleaks/gitleaks-action@v2.3.9 (SHA-pinned per the Action Pinning Policy)
• Adds .gitleaksignore to suppress 7 confirmed false-positive findings in commit 865de69b (documentation file paths containing the substring api-key)

Why this supersedes PR #107

PR #107 (still open) used direct binary install of gitleaks. The compliance audit check (pp_check_secret_scan_ci_job) regex specifically looks for uses: gitleaks/gitleaks-action@ — a binary install does not satisfy it. This PR uses the action.

Action pinning

• gitleaks/gitleaks-action: ff98106e4c7b2bc287b24eaf42907196329070c7 (tag v2.3.9, verified via gh api repos/gitleaks/gitleaks-action/git/refs/tags/v2.3.9)
• actions/checkout: 34e114876b0b11c390a56381ad16ebd13914f8d5 (tag v4, same SHA used throughout ci.yml)

Note on GITLEAKS_LICENSE

gitleaks-action v2 requires a free GITLEAKS_LICENSE key for repos in a GitHub organization. Set this as an org or repo secret named GITLEAKS_LICENSE (obtain one at gitleaks.io). Without it the CI job will fail with a license error.

Closes #96

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 18 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 55 minutes and 18 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 199b373c-7f71-4aeb-90ff-742d21977186

📥 Commits

Reviewing files that changed from the base of the PR and between f9d9937 and 10b3be3.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .gitleaksignore

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-96-20260418-1841

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a GitHub Actions “secret-scan” job using gitleaks/gitleaks-action@v2.3.9 (SHA pinned) and introduces a .gitleaksignore file to suppress confirmed false positives so the new scan can run cleanly.

Changes:

• Adds .gitleaksignore entries for 7 reviewed false-positive findings.
• Adds a secret-scan job to .github/workflows/ci.yml using gitleaks/gitleaks-action (SHA pinned) and full-history checkout.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.gitleaksignore	Adds documented suppression fingerprints for known false positives.
.github/workflows/ci.yml	Adds a new secret-scan job using the gitleaks GitHub Action.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Overriding args may disable the action’s default SARIF/report behavior (depending on the action’s defaults), which would make security-events: write ineffective and prevent Code Scanning results from being published. Consider explicitly adding SARIF output args (for example, setting a report format/path supported by gitleaks-action) so findings are uploaded as code-scanning alerts in addition to failing the job.

Suggested change

	args: detect --source . --redact --verbose --exit-code 1
	args: detect --source . --redact --verbose --exit-code 1 --report-format sarif --report-path gitleaks.sarif

[Copilot]

As written, PRs from forks (or any context where GITLEAKS_LICENSE isn’t available) are likely to fail the workflow outright if the action hard-requires the license in org repos. To keep CI usable for external contributors while preserving coverage for trusted events, consider guarding the job/step with an if: condition (e.g., only run when the secret is present or when the PR comes from the same repo) or splitting behavior by event type (run on push/trusted PRs, skip on forked PRs).

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease