ci(security): enforce gitleaks in github actions

Author: misiektoja

.github/workflows/gitleaks.yml

@@ -0,0 +1,24 @@
+name: Gitleaks
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  scan:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks scan
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_CONFIG: .gitleaks.toml
+          GITLEAKS_ENABLE_COMMENTS: "false"

.gitleaks.toml

@@ -0,0 +1,47 @@
+title = "Shared monitor repos gitleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "monitor-secret-assignment"
+description = "Detects monitor project secret assignments with lower entropy tolerance"
+path = '''(?i)(?:^|/)(?:\.env(?:\.[^/]+)?|[^/]+\.(?:py|env|ini|cfg|conf|toml|ya?ml|json|sh))$'''
+regex = '''(?i)\b(?:steam_api_key|github_token|lastfm_api_key|lastfm_api_secret|riot_api_key|psn_npsso|ms_app_client_secret|sp_app_client_secret|sp_user_client_secret|sp_client_secret|sp_dc_cookie|refresh_token|session_password|smtp_password|sp_sha256)\b(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|:{1,3}=|:|=>|\?=)[\s=]{0,3}[\x60'"]([^\x60'"\s#]{8,256})[\x60'"](?:[\x60'"\s;]|\\[nr]|$)'''
+secretGroup = 1
+entropy = 3.1
+keywords = [
+    "steam_api_key",
+    "github_token",
+    "lastfm_api_key",
+    "lastfm_api_secret",
+    "riot_api_key",
+    "psn_npsso",
+    "ms_app_client_secret",
+    "sp_app_client_secret",
+    "sp_user_client_secret",
+    "sp_client_secret",
+    "sp_dc_cookie",
+    "refresh_token",
+    "session_password",
+    "smtp_password",
+    "sp_sha256",
+]
+
+[[rules.allowlists]]
+description = "Skip placeholders and variable references"
+regexTarget = "secret"
+regexes = [
+    '''(?i)^your_[a-z0-9_]+$''',
+    '''(?i)^example(?:_[a-z0-9_]+)?$''',
+    '''(?i)^dummy(?:_[a-z0-9_]+)?$''',
+    '''(?i)^changeme(?:_[a-z0-9_]+)?$''',
+    '''(?i)^replace(?:_[a-z0-9_]+)?$''',
+    '''(?i)^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)+$''',
+    '''(?i)^[a-z_][a-z0-9_]*\([^\)]{0,80}\)$''',
+    '''(?i)^<[^>]{1,64}>$''',
+    '''(?i)^\$\{?[A-Z0-9_]{2,64}\}?$''',
+    '''(?i)^\$\{?[a-z_][a-z0-9_]{1,63}\}?$''',
+    '''(?i)^x{8,}$''',
+    '''^_+$''',
+]