ci: add pinned gitleaks secret-scan job (#49)

[CodeSolutionsLLC]

Thanks for the pull request. See CONTRIBUTING.md for how changes land on main.

Summary

Add a fail-hard Secret scan sibling job to .github/workflows/validate.yml. It installs the official gitleaks binary (pinned and sha256-verified) and runs gitleaks detect on pull requests and pushes to main.

No third-party GitHub Action. The binary install mirrors the Workflow lint actionlint pattern: download the release tarball and checksums file, require the expected digest line, then sha256sum -c.

permissions: contents: read is unchanged. The job uses the default GITHUB_TOKEN only. Default gitleaks config; no allowlist file.

Related issue

Closes #49

Fixes #49

Pin

• version: 8.30.1
• sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
• source URL: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
• checksums URL: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_checksums.txt

How to verify

Secret scan job is green on this PR (validate run on 8aee932: Markdown structure, Workflow lint, and Secret scan all succeeded).

Local check before push: gitleaks 8.30.1 detect --source . --verbose --redact --no-banner reported no leaks, and actionlint 1.7.12 reported no findings on .github/workflows/validate.yml.

Checklist

• Evidence recorded. Summary and how to verify are filled in (commands, tests, or links). See verify and playbooks/verify.md.
• CI green. Required checks on this pull request are passing, including validate.
• No secrets. The pull request body and diff have no tokens, PATs, private config, or exploit details. Report security issues privately — SECURITY.md.
• CODEOWNERS human merge (no self-merge). Authors wait for an independent human review and merge. Reviewers are listed in .github/CODEOWNERS. See no-self-merge and human-gate.
• Public language safe. No private credentials, internal roster names, or private links.

  

[CodeSolutionsLLC]

Human VERIFY PASS (Computer)

• Paths: .github/workflows/validate.yml only
• Secret scan sibling: pinned gitleaks 8.30.1 sha256 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb (matches release checksums linux_x64)
• No third-party Action; contents: read; fail-hard; timeout 10
• CI green on head 8aee932 (Markdown structure, Workflow lint, Secret scan, CodeQL Analyze)

Await Code merge. Do not self-merge.