feat(security): fail-closed secret-scan gate for the public docs site

[JacobPEvans-personal]

Secret-scan gate for the public docs site

What

Adds a fail-closed gitleaks gate so no
sensitive value can reach docs.jacobpevans.com, and mirrors the change into the
docs themselves.

• .github/workflows/secret-scan.yml — runs on PRs (incl. drafts) and push to
  main. No script: two declarative steps — select the ruleset via shell
  parameter expansion, then scan with the official gitleaks OSS Docker image
  (ghcr.io/gitleaks/gitleaks:v8.30.1). The gitleaks GitHub Action requires a
  paid license for org accounts; the image does not.
• .gitleaks.toml.example — the public-safe generic baseline (built-in
  credential rules + placeholder allowlist + .git skip). It is a template /
  fork fallback, not the active config.
• security/scrubbed-values.mdx — documents the gate (the implementation of
  golden law 1).
• automation/scheduled-routines/claude-code-routines.mdx — registers the new
  Docs Sync routine (six → seven).

Two-layer design (list stays private)

The full org-specific ruleset lives only in the private docs-starlight repo
and reaches CI as the encrypted GITLEAKS_PRIVATE_CONFIG secret, run with
--redact (patterns and matches never appear in public logs). When the secret is
absent (fork PRs), the workflow falls back to the committed
.gitleaks.toml.example via ${GITLEAKS_PRIVATE_CONFIG:-$(cat …)} — so forks
still get credential detection, and full org-specific coverage runs on push to
main.

Validation

• CI green: the Docker image pulls and runs, gitleaks reports no leaks found
  on the docs tree (using the example fallback, since the secret isn't set yet).
• The full ruleset was validated against fixtures (in docs-starlight#17): flags a
  dirty fixture, passes clean content, no false positives on CLAUDE.local.md,
  svc.cluster.local, 192.168.0.x, example.com.

⚠️ Before enabling the full ruleset

Running the full ruleset against the existing docs surfaces 3 pre-existing
visicore references (in observability/overview.mdx and a .claude/ skill).
The GITLEAKS_PRIVATE_CONFIG secret is therefore not set yet — doing so would
make the gate fail-closed on existing content. Decide: strip the refs, allowlist
visicore as intentionally public, or adjust the client-terms rule. Until then,
the gate runs the safe generic baseline (this PR is green on it).

Operator setup (after the decision above)

gh secret set GITLEAKS_PRIVATE_CONFIG --repo dryvist/docs \
  < security/gitleaks-public-docs.toml   # from the docs-starlight checkout

Then make Secret Scan a required check on main.

Related

• dryvist/docs-starlight#17 (merged) — the private ruleset this consumes.
• dryvist/docs-starlight#18 — .git scan-skip follow-up.
• dryvist/claude-code-routines#36 (merged) — the Docs Sync routine.

🤖 Generated with Claude Code