S-125938: Add gitleaks secret scanning

[EllAchE]

Summary

• Add a pinned Gitleaks workflow and default configuration so pull requests and default-branch pushes receive secret scanning.
• Load scanner configuration from the base branch during pull-request scans, preventing the change under review from weakening its own check.

Test plan

• Validate the workflow with Prettier
• Review the gitleaks configuration and workflow diff

Part of S-125938

Agent Audit

• Action: create-pr
• Timestamp: 2026-07-21T20:18:16Z
• Agent: codex
• Agent type: codex
• Triggered by: loganharless
• Origin: loganharless@dev-vm
• Session: 019f8643-2ab0-7112-99cd-19471a75612b
• Source repo: usestring/.usestring
• Worktree: /home/loganharless/worktrees/s-125938-usestring-repos/.usestring
• Branch: s-125938-gitleaks-husky-20260721
• Head commit: e3fad83
• tmux pane: %8
• tmux session: cdx-3124802-79

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3fad83654

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid falling back to scanning only the last pushed commit

When BASE_SHA is not present in the checkout, such as a created/recreated main branch or a force-push whose old tip is no longer fetched, this fallback narrows the scan to HEAD_SHA~1..HEAD_SHA. The next command passes that range to Gitleaks via --log-opts, so any secret introduced in earlier commits from the same pushed update is never examined; for a secret scanner, it is safer to fetch the missing base, scan the full reachable history for that push, or fail closed instead of scanning only one commit.

Useful? React with 👍 / 👎.