feat: add gitleaks secret scanning

.github/workflows/leaked-secrets-scan.yml

@@ -0,0 +1,38 @@
+name: Leaked Secrets Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+jobs:
+  gitleaks-cli:
+    name: gitleaks (CLI)
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_VERSION: '8.30.0'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Run gitleaks
+        run: gitleaks detect --source . --redact -c .gitleaks.toml -v --report-format sarif --report-path gitleaks-report.sarif
+
+      - name: Upload report
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: gitleaks-report
+          path: gitleaks-report.sarif
+          retention-days: 30

.gitleaks.toml

@@ -0,0 +1,2 @@
+# Gitleaks configuration
+# Add path or regex allowlists here if false positives arise

lefthook.yml

@@ -0,0 +1,7 @@
+# Lefthook Git Hooks Configuration
+# Documentation: https://github.com/evilmartians/lefthook/blob/master/docs/configuration.md
+
+pre-push:
+  commands:
+    gitleaks:
+      run: gitleaks protect --staged --redact

package.json

@@ -23,6 +23,7 @@
     "lint:tsc": "pnpm tsc --noEmit",
     "rollup": "rollup --config rollup.config.mjs",
     "storybook": "storybook dev -p 6006 --disable-telemetry",
+    "prepare": "lefthook install",
     "storybook:build": "storybook build -o storybook-static",
     "storybook:publish": "gh-pages -b storybook/publish -d storybook-static"
   },
@@ -81,6 +82,7 @@
     "eslint-plugin-react-hooks": "^5.1.0",
     "file-loader": "^6.2.0",
     "gh-pages": "^6.2.0",
+    "lefthook": "^1.11.0",
     "react-dom": "^18.3.1",
     "react-router-dom": "^7.12.0",
     "rollup": "^4.27.3",