From a167982eb902d5debd8c3a58c256871430bc0c25 Mon Sep 17 00:00:00 2001
From: homelab-gitleaks-rollout <gitleaks-rollout@sirddail.net>
Date: Fri, 31 Jul 2026 21:24:06 +0000
Subject: [PATCH] feat: add gitleaks pre-merge secret scanning (homelab#175)

## Summary
- Rollout of gitleaks pre-merge secret scanning (homelab#166 decision, homelab#175 rollout tracking).
- Canonical two-file template (architecture/secret-scanning.md), no per-repo customization.

## Test plan
- [x] gitleaks CI check on this PR itself is the test.

Automated by `bin/gitleaks-rollout.py` (homelab#175).
---
 .github/workflows/secret-scan.yml | 19 +++++++++++++++++++
 .gitleaks.toml                    |  5 +++++
 2 files changed, 24 insertions(+)
 create mode 100644 .github/workflows/secret-scan.yml
 create mode 100644 .gitleaks.toml

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 0000000..549036c
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,19 @@
+name: secret-scan
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  gitleaks:
+    runs-on: stable-diffution-webui-rcom-runner
+    permissions:
+      contents: read
+      pull-requests: read  # gitleaks-action lists PR commits via the API
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0  # full history for PR diff scans
+      - uses: gitleaks/gitleaks-action@v2.3.7  # pin the tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..31dcb62
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,5 @@
+# Vendored: inherit gitleaks v8.30.1 default rule set. Includes the
+# kubernetes-secret-yaml rule that catches the homelab antipattern.
+# Future homelab-specific rules go below the [extend] block.
+[extend]
+useDefault = true