From 9e68fa2de070c036fe4e78bc491475fdffcfa0cc Mon Sep 17 00:00:00 2001
From: Ryan Iguchi <ryan@netdevs.net>
Date: Wed, 5 Aug 2026 16:48:26 -0700
Subject: [PATCH 1/2] ci: add gitleaks secret scanning on pull requests

---
 .github/workflows/gitleaks.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/gitleaks.yml

diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 0000000..d28531d
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,26 @@
+name: Secret scan (gitleaks)
+
+# Scans only the commits introduced by a PR (gate before merge) so it prevents
+# NEW secrets without failing on pre-existing history. Use the manual
+# "Run workflow" (workflow_dispatch) for a full-history audit.
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
+            LOGOPTS="--log-opts=origin/${{ github.base_ref }}..HEAD"
+          else
+            LOGOPTS=""   # manual run: full-history audit
+          fi
+          docker run --rm -v "$GITHUB_WORKSPACE:/repo" ghcr.io/gitleaks/gitleaks:latest \
+            detect --source=/repo --config=/repo/.gitleaks.toml --redact --verbose --exit-code=1 $LOGOPTS

From 78769438affe1b60d36eb2994e098529c39c7b3a Mon Sep 17 00:00:00 2001
From: Ryan Iguchi <ryan@netdevs.net>
Date: Wed, 5 Aug 2026 16:48:29 -0700
Subject: [PATCH 2/2] ci: add gitleaks config

---
 .gitleaks.toml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..433ce4d
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,14 @@
+# gitleaks config — extends the built-in ruleset with project allowlists.
+title = "gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Allowlisted paths and known non-secret placeholders"
+paths = [
+  '''\.env\.example$''',
+  '''(^|/)env\.example$''',
+  '''(^|/)README\.md$''',
+  '''\.gitleaks\.toml$''',
+]