✨ Add validate-pr-secret workflow with gitleaks-action

[Copilot]

Description

This PR adds automated secret scanning to pull requests using the gitleaks-action. This ensures that sensitive information like API keys, passwords, and tokens are not accidentally committed to the repository.

Changes

• Added .github/workflows/validate-pr-secret.yml workflow that:

  • Runs automatically on all pull request events (opened, edited, reopened, synchronize)
  • Uses gitleaks/gitleaks-action@v2 to scan for secrets
  • Scans the full git history with fetch-depth: 0 for comprehensive detection
  • Follows the same pattern as existing PR validation workflows in the repository

• Added src/githooks/stubs/.github/workflows/validate-pr-secret.yml stub template:

  • Provides the same secret scanning workflow as a template for projects using the githooks devcontainer feature
  • Allows projects to easily adopt secret scanning by including the githooks feature

Benefits

• Automated Security: Catches accidentally committed secrets before they reach the main branch
• Consistent Validation: Aligns with existing PR validation workflows (validate-pr-format.yml)
• Zero Configuration: Works out-of-the-box with gitleaks' default secret detection rules
• Reusable Template: Available as a stub for projects using this devcontainer feature

Example

When a pull request is opened or updated, the workflow will automatically scan for common secret patterns including:

• AWS access keys
• GitHub tokens
• Private keys
• Database credentials
• API keys from popular services

If secrets are detected, the workflow will fail and provide details about the findings, allowing developers to address the issue before merging.

Fixes #33

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add validate-pr-secret</issue_title>
<issue_description>Check pr secrets with https://github.com/gitleaks/gitleaks-action</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #33

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[tomgrv]

@copilot This must also be in a stub

[tomgrv]

@copilot This must also be in a stub

[Copilot]

@copilot This must also be in a stub

Added the workflow to src/githooks/stubs/.github/workflows/validate-pr-secret.yml (commit a9a3240)

[Copilot]

Pull Request Overview

This PR adds automated secret scanning to pull requests using the gitleaks-action to prevent accidentally committed sensitive information like API keys, passwords, and tokens from reaching the main branch.

• Adds GitHub workflow for automated secret detection on all PR events
• Provides reusable template in githooks feature stubs for downstream projects
• Integrates with existing PR validation workflow patterns in the repository

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-pr-secret.yml	Main workflow that runs gitleaks secret scanning on all pull request events
src/githooks/stubs/.github/workflows/validate-pr-secret.yml	Template workflow for projects using the githooks devcontainer feature