feat(security): add gitleaks for secret detection

[ryoppippi]

Summary

• Add gitleaks to detect and prevent secrets from being committed
• Replaces secretlint with a more widely adopted solution

What Changed

• Add .gitleaks.toml configuration with default rules
• Add gitleaks to pre-commit hook via lefthook (runs first in pipeline)
• Add gitleaks job to CI workflow using gitleaks-action
• Add gitleaks to nix flake for local development

---

Summary by cubic

Add Gitleaks for secret detection across pre-commit, CI, and local dev to prevent secrets from being committed. Replaces secretlint with a more widely adopted tool.

• New Features
  • Added .gitleaks.toml with default rules and allowlist for common lock files.
  • Pre-commit: runs gitleaks protect via Lefthook as the first job.
  • CI: added a gitleaks job that runs via Nix using .gitleaks.toml.
  • Nix flake: included gitleaks for local development.

^{Written for commit 71d21cb. Summary will update automatically on new commits.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/StackOneHQ/stackone-ai-node/@stackone/ai@259

commit: 71d21cb

[cubic-dev-ai]

No issues found across 4 files

[Copilot]

Pull request overview

This PR integrates gitleaks as a secret detection tool to prevent sensitive information from being committed to the repository. It replaces the previous secretlint solution with gitleaks, which is more widely adopted in the industry.

Key Changes:

• Configured gitleaks with default rules and file allowlists for lock files and snapshots
• Added gitleaks as the first job in the pre-commit hook pipeline via lefthook
• Integrated gitleaks scanning into the CI workflow as a dedicated job

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.gitleaks.toml	New configuration file with default rules enabled and allowlist for lock files and snapshots
lefthook.yaml	Added gitleaks as the first pre-commit job to scan staged files before other checks
flake.nix	Added gitleaks package to the Nix development environment for local tooling
.github/workflows/ci.yaml	Added gitleaks job with full repository history scanning using the official gitleaks-action

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The allowlist includes 'go.sum' but this appears to be a Node.js/TypeScript project with no Go files. While this doesn't cause any issues, it's unnecessary and could be removed to keep the configuration focused on the actual project structure.

Suggested change

	'''go\.sum$''',
	'''pnpm-lock\.yaml$''',
	]
	'''pnpm-lock\.yaml$''',
	]

[glebedel]

LGTM