ci: add gitleaks secret-scan job to ci.yml

[don-petry]

Summary

• Adds the required secret-scan job to ci.yml per the push-protection standard
• Uses gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 (v2.3.9, SHA verified)
• Scans full git history (fetch-depth: 0) on every PR and push to main
• --redact prevents secrets from appearing in workflow logs
• --exit-code 1 fails the build on any finding

Closes #112

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 54 minutes and 42 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b843a1cb-906f-4820-b134-ae11ee0d66c2

📥 Commits

Reviewing files that changed from the base of the PR and between 8b0d525 and 850619a.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-112-20260414-1227

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry This PR adds the required secret-scan gitleaks job to ci.yml to resolve the compliance finding in #112. Please review and merge when CI is green.

[Copilot]

Pull request overview

Adds a required gitleaks-based secret scanning job to the main CI workflow to satisfy the push-protection compliance check (Issue #112), running on pushes and PRs to main and scanning full git history.

Changes:

• Add a new secret-scan job to .github/workflows/ci.yml using gitleaks/gitleaks-action pinned by SHA.
• Configure checkout with fetch-depth: 0 and run gitleaks detect with --redact and --exit-code 1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This comment references ci-standards.md#action-pinning-policy, but there’s no ci-standards.md in this repo. Please update it to an existing doc/location (or remove). Also, the “Look up current SHA” command points at actions/checkout tag v4, which doesn’t match the version comment on the pinned SHA here—align the lookup command with the version/tag you intend to track.

Suggested change

	# Pin to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0
	- name: Run gitleaks
	# Pinned to SHA per Action Pinning Policy (ci-standards.md#action-pinning-policy).
	# Pinned to a commit SHA for supply-chain safety.
	# Look up current SHA: gh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0
	- name: Run gitleaks
	# Pinned to a commit SHA for supply-chain safety.

[Copilot]

The “Refresh with” command references refs/tags/v2, but the pinned action comment indicates v2.3.9. To avoid accidentally resolving a different tag/commit in the future, update the command (or the comment) so it points at the exact tag/version you expect to pin (e.g., refs/tags/v2.3.9, then dereference if annotated).

Suggested change

	# Refresh with: gh api repos/gitleaks/gitleaks-action/git/refs/tags/v2 --jq '.object.sha'
	# Refresh with: gh api repos/gitleaks/gitleaks-action/git/refs/tags/v2.3.9 --jq '.object.sha'

[don-petry]

Outdated review (superseded by re-review at 13d1cea527b67543eef88c6472c49a049188674c) — click to expand.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

• [major] .github/workflows/ci.yml:172 — Refresh instruction in the checkout step tells future maintainers to run gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha', but the step is pinned to v6.0.2 (SHA de0fac2e...). Verified against upstream: refs/tags/v4 currently resolves to SHA 34e114876b0b11c390a56381ad16ebd13914f8d5, so following this instruction would silently downgrade actions/checkout by two major versions. The currently-committed pin is correct and safe — this is a latent maintenance trap. Change the lookup command to refs/tags/v6.0.2.

• [minor] .github/workflows/ci.yml:182 — The gitleaks-action refresh comment references refs/tags/v2 (a floating major tag) rather than refs/tags/v2.3.9 (the exact version on the pin). A future refresh could silently bind to a different minor/patch version. Update the comment to reference the exact tag.

• [minor] .github/workflows/ci.yml:171 — Both step comments reference ci-standards.md#action-pinning-policy, which does not exist in this repository. Either add the document or remove the reference; as written, reviewers and future maintainers cannot verify what standard the pin is meant to satisfy.

• [minor] Two Copilot inline review threads (comment IDs 3079440360 and 3079440452) flag the two refresh-command defects above and remain unresolved. Their suggested diffs are correct and would address the major and minor findings in one commit.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on main if the branch is behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[don-petry]

CI fix: replaced gitleaks/gitleaks-action with direct CLI install

The Secret scan (gitleaks) job was failing with:

[petry-projects] is an organization. License key is required.

gitleaks/gitleaks-action requires a paid license for GitHub org repos. This commit replaces it with a direct CLI install approach that:

• Downloads gitleaks v8.30.1 binary via wget
• Verifies the download with sha256sum
• Runs gitleaks detect directly (no license needed)

Also removed the now-unnecessary security-events: write permission from the job.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude finished @don-petry's task in 2m 1s —— View job

---

Review comment analysis complete

• Gather context and read current CI file
• Analyze outstanding review comments vs current file state
• Determine what can be fixed (noting workflow file constraints)
• Report findings

---

Finding: All Copilot review issues are already resolved

After reading the current .github/workflows/ci.yml (commit 13d1cea), every issue raised by Copilot and in the cycle-1 review has already been addressed by prior commits on this branch:

Finding	Status	Resolved by
Checkout refresh instruction referenced refs/tags/v4 instead of refs/tags/v6.0.2	✅ Fixed	45c414b — the checkout step no longer has a refresh comment
gitleaks-action refresh comment referenced refs/tags/v2 instead of refs/tags/v2.3.9	✅ Fixed	45c414b — gitleaks-action was replaced entirely with direct CLI install
Both step comments referenced ci-standards.md#action-pinning-policy (non-existent file)	✅ Fixed	45c414b — those comment blocks were removed
SonarCloud security hotspot: GITLEAKS_SHA256 variable name	✅ Fixed	13d1cea — renamed to GITLEAKS_CHECKSUM

One remaining action needed (manual)

The branch is 1 commit behind main (c273ef3 — chore(deps): bump github/codeql-action). The April 21 auto-rebase was blocked because the workflows permission was not available. This needs a manual rebase before the PR can merge:

git fetch origin
git rebase origin/main
git push --force-with-lease

Note: I cannot modify files in .github/workflows/ or perform rebase operations — both are outside the GitHub App's permitted scope. The rebase must be done manually.

Suggested follow-up (no code change needed)

The two Copilot inline review threads (comment IDs 3079440360 and 3079440452) may still appear as "Unresolved" in the GitHub UI even though the underlying code was fixed. Please resolve those threads manually after the rebase to keep the PR clean.

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Dev-Lead Fix CI — failed

PR: #128 | SHA: c9fb14cfe2598ff38e3b3f15416e3b433c7f4eae
Engine invocation failed (exit 41)

[don-petry]

Dev-Lead Fix CI — failed

PR: #128 | SHA: 6776d1388bb40c617ec9dfbf9f67641a467f8dbc
Engine invocation failed (exit 41)

[don-petry]

Dev-Lead Fix CI — exhausted

This PR has had 2 consecutive engine failures (timeouts or errors). Automated CI fixing has been paused to avoid consuming further tokens.

Reason for last failure: Engine invocation failed (exit 41)

To re-enable, delete this comment or push a new commit with a substantially different change.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.