Feature/setup gitleaks

[duongtronghoa6a-debug]

No description provided.

[Copilot]

Pull request overview

Adds a GitLeaks scan workflow for pull requests so secrets can be detected before merging into protected branches.

Changes:

• Introduces a new GitHub Actions workflow that runs on pull_request events targeting main and dev.
• Checks out the full repository history (fetch-depth: 0) and runs gitleaks/gitleaks-action@v2.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This workflow runs the action with its default configuration; it doesn’t pass the repo’s gitleaks.toml, so the existing allowlist/settings used by the nightly scan won’t be applied and PR checks may produce inconsistent/extra findings. Configure the action to use gitleaks.toml (and any required args) so PR scans match the repo’s intended ruleset.

Suggested change

	- uses: gitleaks/gitleaks-action@v2
	- uses: gitleaks/gitleaks-action@v2
	with:
	args: --config=gitleaks.toml

[Copilot]

Consider pinning the GitLeaks engine version for the action (or otherwise aligning it with the pinned zricethezav/gitleaks:v8.18.4 used in the scheduled workflow). Leaving the version implicit can cause the PR check behavior to change over time as new GitLeaks releases/rules ship, creating unexpected failures.

Suggested change

	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	GITLEAKS_VERSION: v8.18.4

[Copilot]

Add an explicit permissions: block (e.g., contents: read) so this workflow doesn’t rely on the repository’s default GITHUB_TOKEN permissions. This follows least-privilege and avoids accidentally granting write permissions to a third-party action if repo defaults change.