Fix Python runner; add gitleaks secret scanning

- All Python jobs now install python3-pip via apt first (runner image has no pip by default) - Added secret-scan job: gitleaks v8.21.2 scans full git history on every push/PR with --redact to avoid leaking found secrets in logs - Added .gitleaks.toml allowlisting deploy/hooks-lxc*.json files (webhook HMAC secrets are intentional config, not leaks) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 16:29:14 -04:00
parent d49b33fc42
commit 371ed8116f
2 changed files with 31 additions and 4 deletions
@@ -0,0 +1,6 @@
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Webhook HMAC secrets in hook config files are intentional"
+paths = ['''deploy/hooks-lxc\d+\.json''']