#480 ci(secret-scan): run the gitleaks CLI instead of gitleaks-action (unblocks fork PRs)

[Anonymous]

Originally created by: fu351

Why

Every contributor PR has failed secret-scan since the repo moved to the DobermanCore org on 2026-08-25: gitleaks-action requires GITLEAKS_LICENSE on organization repos, and fork pull requests cannot read repository/org secrets. Same-repo PRs kept passing (they can read the secret), which hid the breakage. 13 open PRs are red for this reason alone.

What

The job now runs the gitleaks CLI (MIT-licensed tool; no key required) instead of the action:

• download the pinned release v8.30.1 (linux_x64), verify its published sha256, run gitleaks version;
• gitleaks git --no-banner --redact --exit-code 1 . over the full git history (fetch-depth: 0 unchanged), using the repo's existing .gitleaks.toml;
• job id/name secret-scan unchanged, so branch protection keeps requiring it.

Nothing is skipped or weakened: the scan still runs on every push to main and every PR, and still fails the build on any finding. The action's PR-comment feature was already off; its job summary is replaced by the redacted CLI output in the job log.

This PR's own run exercises the new job. After merge, the open contributor PRs need a fresh pull_request event (rebase/push, or close-and-reopen) to pick up the workflow from main.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7XD6aDzEdRfMz7H2XJ8L3

[Anonymous]

Ticket changed by: fu351

• status: open --> closed