🔒 Add Gitleaks Action for Secret Scanning

[rtrofimenkov-ssdlc]

Description

Added a reusable Gitleaks scanning GitHub Action that provides flexible secret scanning capabilities for Deckhouse CI workflows.
The action supports two operation modes and includes built-in logic for diff-based analysis, full repository scans, and post-processing of results.

Features

• Two scan modes:
  • diff — scans only modified or newly added files and lines between the PR base and head commits (tree-only, without repository history).
  • full — performs a complete scan of the entire repository.
• Dynamic configuration detection: automatically loads gitleaks.toml if present in the repository; otherwise, runs with default Gitleaks rules.
• Smart diff detection:
  • Builds a temporary tree of changed files for PRs.
  • Filters results to include only lines actually added in the diff.
  • Ignores deleted, renamed, or unchanged files.
• Comprehensive output:
  • Prints detected findings in a clean, human-readable format in the workflow logs.
  • Generates a Markdown summary table with links to files and lines in GitHub.
  • Publishes the full gitleaks.json report as a workflow artifact.
• Fail-on-leak logic:
  • The job fails only when secrets are found (exit 1), not on internal scan errors.
  • For testing purposes, can be configured to continue on error.
• Compatibility and portability:
  • Designed to be used in both standalone workflows and shared Deckhouse CI pipelines.
  • Fully compatible with public and internal repositories.

---

Why do we need it, and what problem does it solve?

Previously, secret scanning logic was duplicated across workflows.
This modular Action consolidates all scanning functionality in one place, simplifying maintenance and ensuring consistent behavior across repositories.
It provides developers with fast feedback on possible secret leaks in pull requests and allows for deeper scans when required.

---

Why do we need it in the patch release (if we do)?

Not required.
This is an infrastructure and CI improvement that enhances security checks and can be delivered in a regular release.

---

Checklist

• Implemented diff-based and full scan modes.
• Verified automatic configuration detection and proper fallback behavior.
• Confirmed that diff mode scans only changed files and added lines.
• Validated summary and console outputs.
• Verified fail-on-leak behavior and artifact generation.
• Tested in sandbox repository with both modes.

---

Changelog entries

section: ci
type: feature
summary: "Add reusable Gitleaks scanning Action supporting diff and full repository modes with detailed reporting and fail-on-leak logic."
impact: "Introduces a universal secret scanning module used across Deckhouse workflows. Enables fast diff scans for PRs and full scans for scheduled or manual runs."
impact_level: low

[himax1991]

Why we are replacing go linter action?

[rtrofimenkov-ssdlc]

Thanks a lot! That was definitely an accident. I’ve rebased to resolve the issue and cleaned up the branch.