ci: add gitleaks secret scan to detect committed API credentials

.github/workflows/secret-scan.yml

@@ -0,0 +1,37 @@
+name: Secret scan
+
+# Fails if an API key, token or other credential is committed anywhere in the
+# repository's history. Uses the gitleaks CLI directly (gitleaks-action needs
+# a paid license for organization repos). Known historical findings are
+# allowlisted by fingerprint in .gitleaksignore.
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_VERSION: 8.28.0
+      GITLEAKS_SHA256: a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${TARBALL}"
+          echo "${GITLEAKS_SHA256}  ${TARBALL}" | sha256sum -c -
+          tar -xzf "$TARBALL" gitleaks
+          sudo mv gitleaks /usr/local/bin/
+
+      - name: Scan git history
+        run: gitleaks git --redact --verbose .

.gitleaksignore

@@ -0,0 +1,6 @@
+# Known historical leaks: Healthchecks API keys hardcoded in the since-removed
+# internal/status package. The keys have been removed, but they remain in git
+# history, so they are allowlisted by fingerprint here.
+# Do not add new entries for real secrets — remove the secret and rotate it.
+03293f2e471b05dc6327ebb9d95144ce89ea433d:internal/status/status.go:generic-api-key:46
+bd9c129a0c64e8b0a293d8eaf03f48554b3475f1:internal/status/status.go:generic-api-key:47