feat: Add Gitleaks configuration for secret scanning and update CI workflow to include Gitleaks license and custom config.

Author: Arnel Jan Sarmiento

.github/workflows/ci.yml

@@ -57,4 +57,7 @@ jobs:
           fetch-depth: 0
       - uses: gitleaks/gitleaks-action@v2
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+        with:
+          args: detect --source . --redact --no-git --config .gitleaks.toml

.gitleaks.toml

@@ -0,0 +1,11 @@
+title = "Durianpy gitleaks configuration"
+
+# Keep this minimal: use Gitleaks' built-in rules and add only repo-specific allowlists.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Allowlists for known non-secret patterns and generated artifacts in Durianpy infrastructure"
+
+# Avoid scanning common vendor/lock artifacts and build caches in commits.
+paths = []