ci: add gitleaks secret scanning

Author: suguanYang

.github/workflows/secret-scan.yml

@@ -0,0 +1,80 @@
+name: Secret Scan
+
+on:
+  pull_request:
+    branches:
+      - main
+      - staging
+  push:
+    branches:
+      - main
+      - staging
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * *"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install gitleaks
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="8.30.1"
+          archive="gitleaks_${version}_linux_x64.tar.gz"
+          curl --fail --location --silent --show-error \
+            --output "${archive}" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${version}/${archive}"
+          tar -xzf "${archive}" gitleaks
+          install -m 0755 gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+
+      - name: Scan current tree
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p secret-scan-results
+          gitleaks dir . \
+            --no-banner \
+            --redact=100 \
+            --report-format json \
+            --report-path secret-scan-results/gitleaks-tree-findings.json \
+            --exit-code 1
+
+      - name: Scan git history
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p secret-scan-results
+          gitleaks git . \
+            --log-opts="--all --full-history -m" \
+            --no-banner \
+            --redact=100 \
+            --report-format json \
+            --report-path secret-scan-results/gitleaks-history-findings.json \
+            --exit-code 1
+
+      - name: Upload redacted scan report
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gitleaks-redacted-findings
+          path: secret-scan-results/*.json
+          if-no-files-found: ignore