ci: add secret-scan (gitleaks) job for push-protection compliance

[don-petry]

Summary

• Adds the required secret-scan job to .github/workflows/ci.yml per Layer 3 of the push-protection standard. This satisfies the secret_scan_ci_job_present compliance check (error severity).
• Also applied security_and_analysis settings via the GitHub API: secret scanning, push protection, and Dependabot security updates are now enabled at the repo level. This addresses the root cause of the security_and_analysis_unavailable compliance warning.

Job properties:

• Full-history checkout (fetch-depth: 0) — scans all commits, not just the PR diff
• --redact — leaked values are never written to workflow logs
• --exit-code 1 — build fails on any finding
• Both actions pinned to commit SHAs per Action Pinning Policy

Supersedes: #106 (same secret-scan job, on a stale branch — that PR can be closed)

Remaining human-action items (cannot be done in code)

The following settings could not be enabled via API (likely plan limitations):

• secret_scanning_ai_detection — not returned by the API (may require a paid plan)
• secret_scanning_non_provider_patterns — returned as disabled after our PATCH

An org admin should verify in GitHub Settings → Code security whether these features are available on the current plan and enable them if possible.

Test plan

• CI passes (secret-scan job runs cleanly — no secrets in history)
• Weekly compliance audit no longer reports security_and_analysis_unavailable
• Verify GitHub Settings → Code security shows secret scanning + push protection enabled

Closes #95

Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@github-actions[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 58 minutes and 29 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2d60a897-699f-4529-a66c-f30853dd096d

📥 Commits

Reviewing files that changed from the base of the PR and between 0c85a39 and cb0a43b.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .gitleaks.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-95-20260418-1841

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — this PR addresses issue #95 by:

1. Adding the secret-scan (gitleaks) job to ci.yml per Layer 3 of the push-protection standard. Satisfies the secret_scan_ci_job_present compliance check (error severity).

2. Enabling repo-level security settings via API: secret scanning, push protection, and Dependabot security updates are now enabled, which should resolve the security_and_analysis_unavailable warning on the next weekly audit.

This supersedes PR #106 (same fix, on a stale branch).

Remaining items requiring human admin action:

• secret_scanning_ai_detection and secret_scanning_non_provider_patterns could not be enabled (likely plan limitations — the API returned them as disabled after the PATCH). Please verify in GitHub Settings → Code security and enable if available on your plan.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a dedicated CI job to run gitleaks secret scanning to satisfy push-protection compliance requirements and fail CI on detected leaks.

Changes:

• Introduces a new secret-scan job in CI that checks out full git history and runs gitleaks detect.
• Pins the actions/checkout and gitleaks/gitleaks-action actions to commit SHAs.
• Configures gitleaks to redact findings and exit non-zero on detections.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[don-petry]

CI fix: replaced gitleaks/gitleaks-action with direct CLI install

The Secret scan (gitleaks) job was failing with:

[petry-projects] is an organization. License key is required.

gitleaks/gitleaks-action requires a paid license for GitHub org repos. This commit replaces it with a direct CLI install approach that:

• Downloads gitleaks v8.30.1 binary via wget
• Verifies the download with sha256sum
• Runs gitleaks detect directly (no license needed)

Also removed the now-unnecessary security-events: write permission from the job.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude finished @don-petry's task in 4m 41s —— View job

---

Review Comments Analysis

Note: I cannot modify files in .github/workflows/ — the GitHub App token used by this automation does not have workflows permission. For the workflow changes below, I've provided exact diffs to apply manually. I can handle changes to other files (.gitleaks.toml, sonar-project.properties, etc.).

---

Copilot Comment 1 — security-events: write permission

Status: Already fixed ✅

Commit 0b8cd62 (replace gitleaks-action with direct CLI install) already dropped the security-events: write permission. The current secret-scan job only has contents: read (line 99–100 of ci.yml). No action needed.

---

Copilot Comment 2 — fetch-depth: 0 needs a compliance justification comment

Status: Needs manual change — cannot modify workflow file

The current step name Checkout (full history) is partially descriptive, but Copilot asked for an inline comment to prevent future "optimization" regressions. Apply this to .github/workflows/ci.yml:

      - name: Checkout (full history)
        # fetch-depth: 0 is intentional — gitleaks scans all commits in history,
        # not just the PR diff, per push-protection standard Layer 3.
        # Do NOT change to a shallow clone; that would silently miss older leaked secrets.
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

---

Copilot Comment 3 — Incorrect checkout SHA / version comment

Status: Needs manual change — cannot modify workflow file

The secret-scan job uses a different SHA and an incorrect version label compared to all other jobs in the file:

Job	SHA	Comment
detect, backend, frontend	34e114876b0b11c390a56381ad16ebd13914f8d5	# v4
secret-scan (current)	de0fac2e4500dabe0009e67214ff5f5447ce83dd	# v6.0.2 ← incorrect; v6 doesn't exist

The fix is included in the snippet above — use 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 consistently.

---

Copilot Comment 4 — Repo-level security settings not auditable in PR diff

Status: Documentation only — no code change needed

This is a PR description concern. The settings were applied via the GitHub API outside the diff. The explanation already lives in the PR description and in @don-petry's comment. Nothing to change in code.

---

SonarCloud — 1 Security Hotspot / C Security Rating

Status: Needs SonarCloud UI action — cannot suppress via code

The GITLEAKS_CHECKSUM env value (551f6fc8…) is a SHA256 binary integrity checksum, but SonarCloud's hardcoded-credentials detector is flagging the long hex string as a potential secret. This is a false positive.

Security hotspots in SonarCloud cannot be suppressed via sonar-project.properties properties — they must be resolved through the UI:

1. Go to the SonarCloud PR analysis
2. Open the flagged hotspot
3. Click Review → Safe with justification: "This is a SHA256 integrity checksum for a public binary download, not a credential or secret."

Once marked Safe, the quality gate will pass without any code change.

---

CodeRabbit

Status: No actionable comments — rate-limited during review

CodeRabbit hit its hourly commit review limit and did not produce specific code comments on this PR. No items to address.

---

Summary

Comment	Status
security-events: write unused	✅ Already fixed (commit 0b8cd62)
fetch-depth: 0 compliance comment	⚠️ Apply manually (snippet above)
Incorrect checkout SHA # v6.0.2	⚠️ Apply manually (snippet above)
Repo settings not in PR diff	ℹ️ Documentation only
SonarCloud security hotspot	⚠️ Review in SonarCloud UI → mark Safe
CodeRabbit	ℹ️ Rate-limited, no items

Two workflow changes and one SonarCloud UI action are needed manually — I'm unable to modify .github/workflows/ files directly. The two changes are combined into a single snippet in Comment 2 above.

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Dev-Lead Fix CI — failed

PR: #115 | SHA: 4912084426cbd0918d4ec29bba1882f004f07902
Engine invocation failed (exit 41)

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: cb0a43b122e7ec29074777c40261d00490644b87
Cascade: triage → audit (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

Forensic verification dismisses the deep review's CRITICAL claim of a secret in git history: commit fd24ebb is a verified empty commit (0 files/0 additions per /compare API) — likely a CI-trigger no-op, not a leaked credential. Likewise, actions/checkout v6.0.2 (SHA de0fac2) and golangci-lint-action v6.5.2 (SHA 55c2c14) are confirmed as official release commits, and the gitleaks 8.30.1 SHA256 matches the GitHub Release asset digest. However, audit uncovered a defect both prior tiers missed: the merged ci.yml at the PR head contains TWO jobs with the id secret-scan (lines 96 and 156) — the PR's new job and an apparently newer main-branch job using gitleaks/gitleaks-action — which is invalid GitHub Actions YAML and is the underlying cause of the persistent merge conflicts. Escalate for human resolution of the duplicate-job collision, justification of the v9→v6 lint action downgrade, and SonarCloud hotspot review.

Findings

• CRITICAL: Merged ci.yml at PR head (cb0a43b) defines two jobs with the same id secret-scan — the one this PR adds (line 96, custom wget+sha256sum+gitleaks CLI) and a second one that has landed on main (line 156, gitleaks/gitleaks-action@v2.3.9 using GITLEAKS_LICENSE secret). YAML duplicate mapping keys are invalid and GitHub Actions rejects the workflow. This is the actual root cause of the recurring merge conflicts the auto-rebase bot cannot resolve. A human with workflows-write permission must rebase and either (a) drop this PR's job in favor of main's gitleaks-action job, or (b) keep this PR's CLI-based job and remove main's. The PR cannot land as-is.
• MAJOR: PR is CONFLICTING / DIRTY. Auto-rebase has failed repeatedly since 2026-05-25, with the most recent attempt today (2026-06-01). The auto-rebase bot lacks workflows-write permission, so only a human can resolve. Until the duplicate-job collision above is resolved by a manual rebase, this PR is unmergeable.
• MAJOR: SonarCloud Quality Gate failed twice on this PR (1 Security Hotspot, C Security Rating on New Code) flagging GITLEAKS_CHECKSUM as a possible secret. Verified false positive: the value 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb is the official SHA256 of gitleaks_8.30.1_linux_x64.tar.gz (matches the GitHub Release asset digest exactly). The hotspot still needs to be marked Reviewed/Safe in the SonarCloud UI before the gate will pass; this is a manual step a maintainer must take.
• MAJOR: golangci-lint-action is downgraded from v9.2.0 (SHA 1e7e51e) to v6.5.2 (SHA 55c2c14, mislabeled as # v6 in the workflow). SHA 55c2c14 IS a verified official tag (v6.5.2, authored by golangci maintainer Fernandez Ludovic on 2025-03-17) — not a forked or tampered commit. However, the 3-major-version downgrade is unexplained in the PR description and unrelated to the stated secret-scanning purpose of the PR. It should either be reverted, justified (e.g., compatibility with current go.mod), or split into a separate PR. The version comment should also be tightened from # v6 to # v6.5.2 per repo pinning conventions.
• MINOR: The new secret-scan job pins actions/checkout to SHA de0fac2 # v6.0.2 while every other job in ci.yml uses SHA 34e1148 # v4. Both SHAs are verified-legitimate (v6.0.2 was released 2026-01-09, v4 still in use elsewhere), so there is no supply-chain risk, but the inconsistency is unnecessary and risks confusion. Recommend using v4 here too unless v6.0.2 is needed for a specific reason.
• INFO: .gitleaks.toml allowlists the entire _bmad/ path. Verify before merge that this directory only contains BMAD AI knowledge artifacts (no real credentials present as example values). The org-level AGENTS.md confirms a BMAD workflow exists in this repo, so the allowlist is purpose-built rather than suspicious — but the scope is broad.
• INFO: Deep review flagged commit fd24ebb ('test: verify gitleaks with license secret', authored by claude@anthropic.com 2026-04-28) as possibly containing a real secret in git history. Forensic verification via the GitHub /compare API (2670b67…fd24ebb) shows ahead_by=1, files_count=0, total additions=0, total deletions=0 — the commit is COMPLETELY EMPTY. The title 'license secret' most likely refers to gitleaks' built-in license-key detection rule or the GITLEAKS_LICENSE env var (used by the gitleaks-action variant on main); the empty commit was almost certainly used to re-trigger CI. No secret exists in this commit. The Tier 2 CRITICAL is downgraded to INFO.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.