From a2d7a6c02522cabada28b05f64a9da7c39228462 Mon Sep 17 00:00:00 2001
From: arybach <54408501+arybach@users.noreply.github.com>
Date: Wed, 26 Aug 2026 14:08:21 -0400
Subject: [PATCH] ci: add gitleaks secret-scan (SCM-SECRETSCAN-001)

---
 .github/workflows/secret-scan.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .github/workflows/secret-scan.yml

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 0000000..755def1
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,30 @@
+name: secret-scan
+# Detects committed secrets with the gitleaks BINARY (free; no org license needed — the gitleaks Action
+# requires a paid license for organizations, the binary does not). --redact guarantees no secret VALUE is ever
+# printed in logs. Added by the compliance hardening pass as the plan-independent substitute for GitHub's
+# native secret scanning, which is a paid add-on on private repos. A failing run means a real secret is
+# committed: rotate it and purge it from history.
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks (redacted)
+        run: |
+          set -euo pipefail
+          ver="$(curl -sSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest \
+                 | grep -oP '"tag_name": *"v\K[^"]+')"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${ver}/gitleaks_${ver}_linux_x64.tar.gz" \
+                 | tar -xz gitleaks
+          ./gitleaks detect --source . --redact --no-banner --exit-code 1