Add Gitleaks scan job to CI, wired to org-required license key

[Copilot]

Gitleaks.io requires a license key for organization-owned repositories. GITLEAKS_KEY was already added as a repository secret, but no workflow consumed it.

CI workflow (.github/workflows/ci.yml)

• Added a new gitleaks job running gitleaks/gitleaks-action (pinned to v2 SHA)
• Checkout uses fetch-depth: 0 so gitleaks can scan full git history, not just the latest commit
• Maps the existing GITLEAKS_KEY secret to the GITLEAKS_LICENSE env var the action expects
• Grants pull-requests: write at the job level so gitleaks-action can post PR review comments on detected leaks

gitleaks:
  name: Gitleaks Scan
  runs-on: ubuntu-latest
  permissions:
    contents: read
    pull-requests: write
  steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        fetch-depth: 0
    - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_KEY }}

This runs alongside the existing TruffleHog security job rather than replacing it, giving two independent secret-scanning signals.

[Copilot]

Pull request overview

Adds a dedicated Gitleaks secret-scanning job to the existing CI workflow, wiring in the org-required license secret so the action can run in this repository.

Changes:

• Add a new gitleaks job using gitleaks/gitleaks-action pinned by SHA.
• Fetch full git history (fetch-depth: 0) for Gitleaks scanning.
• Map repository secret GITLEAKS_KEY to GITLEAKS_LICENSE and grant pull-requests: write so the action can comment on PRs.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.