Security workflows: fix DevSkim, replace defunct Xanitizer with Gitleaks

.github/workflows/devskim.yml

@@ -21,6 +21,10 @@ jobs:
       security-events: write
       actions: read
 
+    # checkout@v4 and upload-sarif@v3 use Node.js 20; allow until updated
+    env:
+      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -31,7 +35,10 @@ jobs:
           directory-to-scan: .
           should-scan-archives: false
           output-filename: devskim-results.sarif
-          output-directory: ${{ github.workspace }}
+          # Use '.' so the entrypoint resolves to /github/workspace/devskim-results.sarif
+          # inside the container (passing ${{ github.workspace }} causes it to
+          # prepend /github/workspace to the runner absolute path, creating a bad path)
+          output-directory: '.'
 
       - name: Upload SARIF to Code Scanning
         uses: github/codeql-action/upload-sarif@v3

.github/workflows/gitleaks.yml

@@ -0,0 +1,36 @@
+name: CG Gitleaks Secret Scan
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '23 9 * * 5'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      # Allow the action to annotate pull requests with any findings
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # Full history so Gitleaks can scan every commit for secrets
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # GITLEAKS_LICENSE is only required for GitHub Organization accounts.
+          # This repository lives under a personal account, so none is needed.