feat: add gitleaks secret scanning to CI pipeline

Runs gitleaks detect with full history before the build job.
Both test and secrets jobs must pass to gate image push.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -16,8 +16,19 @@ jobs:
       - run: ruff check src/ tests/
       - run: PYTHONPATH=src pytest tests/ -v
 
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_8.24.0_linux_x64.tar.gz \
+            | tar xz -C /usr/local/bin gitleaks
+      - run: gitleaks detect --source . -v
+
   build:
-    needs: test
+    needs: [test, secrets]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

docs/CHEATSHEET.md

@@ -37,8 +37,9 @@ Dev override: compose.yaml mounts `./src` (ro) over the baked-in source.
 
 Gitea Actions runs on push to `main`:
 
-1. `ruff check` + `pytest` in `python:3.13-slim`
+1. `ruff check` + `pytest` (test)
-2. Build + push `harbor.mymx.me/s5p/s5p:latest`
+2. `gitleaks detect` (secrets scan)
+3. Build + push `harbor.mymx.me/s5p/s5p:latest`
 
 Secrets: `HARBOR_USER` / `HARBOR_PASS` (configured in Gitea repo settings).