chore: add scan workflow with leaks/vulns/scan scripts; rename setversion to vers

Author: roll

.github/workflows/scan.yaml

@@ -0,0 +1,53 @@
+name: scan
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  vulns:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v5
+      - name: Setup Pnpm
+        uses: pnpm/action-setup@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: package.json
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install Semgrep
+        run: pip install semgrep
+      - name: Run Vulnerability Scan
+        run: pnpm vulns
+
+  leaks:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Setup Pnpm
+        uses: pnpm/action-setup@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: package.json
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz -C /usr/local/bin gitleaks
+      - name: Run Secrets Scan
+        run: pnpm leaks

.gitleaks.toml

@@ -0,0 +1,10 @@
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Test fixtures may contain placeholder credentials"
+paths = ['''(^|\/)fixtures\/.*''']
+
+[[allowlists]]
+description = "Tests may contain placeholder credentials"
+paths = ['''\.unit\.ts$''', '''\.spec\.ts$''']

package.json

@@ -27,10 +27,13 @@
     "lint": "vp fmt --check && vp lint",
     "prepare": "lefthook install",
     "release": "pnpm publish --access public --ignore-scripts --no-git-checks",
-    "setversion": "pnpm version --no-git-tag-version",
     "test": "pnpm lint && pnpm type && pnpm unit",
     "type": "tsgo --noEmit",
-    "unit": "vp test"
+    "unit": "vp test",
+    "leaks": "gitleaks git --config=.gitleaks.toml --verbose --redact",
+    "vulns": "semgrep --config=p/typescript --config=p/nodejs --config=p/owasp-top-ten --config=p/secrets --exclude=\"**/fixtures/**\" --metrics=off",
+    "scan": "pnpm leaks && pnpm vulns",
+    "vers": "pnpm version --no-git-tag-version"
   },
   "dependencies": {
     "mdast-util-to-string": "^4.0.0",