ci: add a gitleaks workflow that scans the commits of each PR

[tabedzki]

🤖 AI text below 🤖

Problem

This repo has no secret scanning in CI.

What changed

Adds a gitleaks workflow (and .github/scripts/gitleaks-changes.sh, the same script used in U19-pipeline-python). On a pull request or push it scans every commit since the base, plus the lines each merge commit introduced itself, so a secret typed in while resolving a conflict is caught too. It does not rescan old history on every run. There is no manual-run trigger: a run without a base to scan from could not check anything.

• The gitleaks binary is pinned to 8.30.1 and its sha256 is verified before use (a wrong checksum fails the job).
• Actions are SHA-pinned, permissions: contents: read, persist-credentials: false; zizmor reports no findings.
• The gitleaks job is not a required check (no ruleset on this repo).

Testing

The script was run against a scratch repo: a PR range with a token committed in an earlier commit fails (1 github-pat finding); an unchanged range, an all-zeros base and a clean range pass; an empty base fails. The install step was run with the real and a wrong checksum.

Assisted-by: ClaudeCode:claude-sonnet-5-5

[tabedzki]

🤖 AI text below 🤖

Closed without merging, and it cannot be reopened.

This repo only holds the built site. Its default branch, gh-pages, is rewritten on every docs deploy: deploy.yml in BrainCOGS/VRrigs-documentation publishes .vitepress/dist here with crazy-max/ghaction-github-pages, which leaves a single parentless commit. This PR branch has no history in common with that commit, so GitHub will not reopen it. A workflow merged here would also be deleted by the next deploy.

The sources are scanned for secrets in VRrigs-documentation (BrainCOGS/VRrigs-documentation#49), so only built HTML reaches this repo. If scanning of the published output is wanted, add the step to the deploy job there, before the publish step.

The branch tabedzki/ci/gitleaks-pr-scan is left in place and can be deleted.