Security: fail CI when a commit adds a secret

.github/workflows/secret-scan.yml

@@ -0,0 +1,33 @@
+name: Secret scan
+
+# Fails when a pull request or a push to main adds a commit containing a secret.
+# Rules live in .gitleaks.toml. Only the new commits are scanned, so history
+# that was already published does not block unrelated changes.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks 8.30.1
+        run: |
+          curl -sSfL -o gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz gitleaks
+
+      - name: Scan new commits
+        env:
+          RANGE: ${{ github.event_name == 'pull_request' && format('{0}..{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.sha) }}
+        run: ./gitleaks git . --redact --no-banner --log-opts="$RANGE"

.gitleaks.toml

@@ -0,0 +1,18 @@
+# Secret scanning rules for gitleaks (used by .github/workflows/secret-scan.yml).
+# Starts from the built-in gitleaks rules and adds formats they don't cover.
+title = "syllo secret scanning"
+
+[extend]
+useDefault = true
+
+# Comfy platform API keys (platform.comfy.org/profile/api-keys): "comfyui-" plus 64 hex chars.
+# The built-in rules do not recognise this format.
+[[rules]]
+id = "comfy-api-key"
+description = "Comfy platform API key"
+regex = '''\bcomfyui-[0-9a-f]{64}\b'''
+keywords = ["comfyui-"]
+
+[[allowlists]]
+description = "Vendored agent skill docs; their examples use sample tokens"
+paths = ['''^\.agents/''']