fix: use gitleaks CLI instead of licensed action, fix lint errors

- Replace gitleaks-action (requires paid license) with direct CLI
  invocation -- same engine, no license needed
- Fix ruff I001 import sorting in voice.py and test_llm.py
- Remove unused imports: _chat_request (test_llm), Path (test_music)
- Remove unused assignment: original_spawn (test_voice)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -12,9 +12,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
-        env:
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+      - name: Install gitleaks
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_8.24.3_linux_x64.tar.gz \
+            | tar xz -C /usr/local/bin gitleaks
+      - name: Scan for secrets
+        run: gitleaks detect --source . --verbose
 
   lint:
     runs-on: ubuntu-latest

plugins/voice.py

@@ -13,8 +13,8 @@ import json
 import logging
 import threading
 import time
-import wave
 import urllib.request
+import wave
 
 from derp.http import urlopen as _urlopen
 from derp.plugin import command

tests/test_llm.py

@@ -23,7 +23,6 @@ from plugins.llm import (  # noqa: E402
     _COOLDOWN,
     _MAX_HISTORY,
     _MAX_REPLY_LEN,
-    _chat_request,
     _check_cooldown,
     _extract_reply,
     _get_api_key,
@@ -35,7 +34,6 @@ from plugins.llm import (  # noqa: E402
     cmd_chat,
 )
 
-
 # -- Helpers -----------------------------------------------------------------
 
 class _FakeState:

tests/test_music.py

@@ -4,7 +4,6 @@ import asyncio
 import importlib.util
 import sys
 import time
-from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock, patch
 
 # -- Load plugin module directly ---------------------------------------------

tests/test_voice.py

@@ -182,7 +182,6 @@ class TestSayCommand:
         msg = _Msg(text="!say hello world")
 
         spawned = []
-        original_spawn = bot._spawn
 
         def track_spawn(coro, *, name=None):
             spawned.append(name)