ci: add secret scanning on pull requests

[guiddeco-idans-claude]

Secret Scanning on Pull Requests

Adds .github/workflows/secret-scanning.yaml, which calls the shared
guiddeco/shared-workflows/.github/workflows/ci-secret-scanning.yaml@v1
reusable workflow on every PR targeting a long-lived branch.

• Runs in report-only mode (fail_on_findings: false) — it comments findings on
  the PR but does not block the merge.
• Top-level permissions: {} with read-only job scope plus pull-requests: write
  for the findings comment.

Part of an org-wide rollout — the same PR is open on every non-archived repo.

[overcut-ai]

Completed Working on "Code Review "

✅ Review publishing complete. Posted all chunk comments and submitted final review. Review submitted: COMMENT. Total comments: 1 across 1 files.

✅ Workflow completed successfully.

---

👉 View complete log

[overcut-ai]

Review Summary

Findings by severity

• BLOCKER: 0
• CRITICAL: 0
• MAJOR: 1
• MINOR: 0
• SUGGESTION: 0
• PRAISE: 0

Key themes

• PR trigger choice may reduce secret-scanning coverage for fork-based contributions.

Actionable next steps

1. Decide whether forked PR coverage is required for this repository/workflow.
2. If yes, switch to pull_request_target with strict safe-checkout safeguards in the reusable workflow path.
3. If no, explicitly document that forked PRs are out of scope so the reduced coverage is intentional and visible.

[overcut-ai]

[major]: Using pull_request can prevent repository secrets from being available on runs originating from forks, which may cause this org-wide secret scanning workflow to silently lose coverage on external contributions. If the reusable workflow is designed for safe read-only execution, consider using pull_request_target (with strict checkout/ref handling) or explicitly document that forked PRs are out of scope.

[guiddeco-idans-claude]

Closing this — secret scanning is now enforced through an organization-level ruleset that applies to every repository, so a per-repo workflow is redundant. No action needed here; the branch has been deleted.