feat: add secrets scanning workflow

.github/workflows/loopme-secrets-scan.yml

@@ -0,0 +1,29 @@
+# ============================================================
+# Secrets Scan — managed by loopme/secrets
+# DO NOT edit scanning logic here. To update rules or
+# add exclusions, see: https://github.com/loopme/secrets/blob/main/docs/adding-exclusions.md
+# ============================================================
+name: Loopme Secrets Scanning
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+      - develop
+  workflow_dispatch:
+
+jobs:
+  scan:
+    uses: loopme/secrets/.github/workflows/loopme-secrets-scan.yml@main
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+      SECRETS_SCAN_APP_ID_GITHUB: ${{ secrets.SECRETS_SCAN_APP_ID_GITHUB }}
+      SECRETS_SCAN_APP_PRIVATE_KEY_GITHUB: ${{ secrets.SECRETS_SCAN_APP_PRIVATE_KEY_GITHUB }}
+    # Optional inputs — uncomment to customise:
+    # with:
+    #   config-file: .gitleaks.toml          # path to repo-local config (default: .gitleaks.toml)
+    #   notify-user-list: "@user1,@user2"    # GitHub users to @-mention in PR comments
+    #   extra-arguments: "--verbose"          # any extra gitleaks flags
+    #   enable-comments: true                 # set to false to suppress inline PR comments (check still fails)

.gitleaks.toml

@@ -0,0 +1,13 @@
+# Default repository-local gitleaks configuration.
+# This file is used automatically when a repo has no .gitleaks.toml.
+# Copy it to your repo root as .gitleaks.toml and add your exclusions.
+# See: https://github.com/loopme/secrets/blob/main/docs/adding-exclusions.md
+
+# Use all built-in gitleaks default rules
+[extend]
+  useDefault = true
+
+[allowlist]
+  description = "global allowlist"
+  regexes = []
+  paths = []