S-125938: Add gitleaks secret scanning

.github/workflows/gitleaks.yml

@@ -0,0 +1,54 @@
+name: Gitleaks
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  gitleaks:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no_gha') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Restore gitleaks config from base branch
+        if: github.event_name == 'pull_request'
+        run: |
+          if git show "origin/${{ github.base_ref }}:.gitleaks.toml" 2>/dev/null > .gitleaks.toml.base; then
+            mv .gitleaks.toml.base .gitleaks.toml
+          else
+            rm -f .gitleaks.toml.base
+            echo "No .gitleaks.toml on base branch; using checked-out copy (bootstrap)."
+          fi
+
+          if git show "origin/${{ github.base_ref }}:.gitleaksignore" 2>/dev/null > .gitleaksignore; then
+            echo "Loaded .gitleaksignore from base branch."
+          else
+            rm -f .gitleaksignore
+            echo "No .gitleaksignore on base branch; fingerprint suppression disabled."
+          fi
+
+      - name: Scan PR / pushed commits for secrets
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          if ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
+            BASE_SHA="$HEAD_SHA~1"
+          fi
+          gitleaks git --no-banner --redact --ignore-gitleaks-allow --config .gitleaks.toml \
+            --log-opts="$BASE_SHA..$HEAD_SHA"

.gitleaks.toml

@@ -0,0 +1,2 @@
+[extend]
+useDefault = true