Implement repository-wide secret scanning with Gitleaks and basic secret hygiene

[Copilot]

This PR implements comprehensive secret scanning using Gitleaks to prevent accidental exposure of sensitive credentials like API tokens and keys in the repository.

What's Added

GitHub Actions Workflow (.github/workflows/secret-scan-gitleaks.yml)

• Automated scanning on every pull request and push to all branches
• Manual workflow dispatch with option to scan full git history
• Conditional behavior: Fails PR checks when secrets are detected, but allows push events to succeed while still uploading findings
• SARIF integration: Uploads scan results to GitHub's Security tab for centralized vulnerability management
• Comprehensive reporting: Includes job summaries and downloadable artifacts

Gitleaks Configuration (.gitleaks.toml)

• Uses default Gitleaks rules as baseline for comprehensive coverage
• Smart allowlist for common placeholders like your_bot_token_here, TELEGRAM_TOKEN=, and documentation examples
• Excludes .env.example files from scanning to avoid false positives on template files

Secret Management Improvements

• .env.example: Template file showing required environment variables without exposing real values
• Enhanced .gitignore: Properly excludes all environment files (.env, .env.*) while tracking the example template
• Gitleaks cache: Ignores .gitleaks-cache to improve scan performance

Security Benefits

1. Prevention: Blocks PRs containing secrets before they're merged
2. Detection: Scans existing codebase and reports findings in Security tab
3. Monitoring: Continuous scanning of all new commits
4. Documentation: Clear guidance on proper secret management via .env.example

Testing

The configuration has been tested locally and successfully:

• ✅ No false positives on existing codebase
• ✅ Correctly generates SARIF reports
• ✅ Allowlist properly excludes known placeholder values
• ✅ Maintains existing functionality without disruption

This implementation follows security best practices while maintaining developer workflow efficiency. The bot will continue to read TELEGRAM_TOKEN from environment variables as before, but now we have safeguards to prevent accidental token exposure in the repository.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Join our Discord community for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.