Add Gitleaks for secret scanning

[massongit]

Fixes #1856

Proposed Changes

Gitleaks is a SAST tool for detecting hardcoded secrets.
We can notice the committed credentials by adding them as CI.

Readiness Checklist

Author/Contributor

• If documentation is needed for this change, has that been included in this pull request

Reviewing Maintainer

• Label as breaking if this is a large fundamental change
• Label as either automation, bug, documentation, enhancement, infrastructure, or performance

[JonZeolla]

Can you comment as to why secretlint was preferred over some of the alternatives? Personally, I am a fan of https://github.com/zricethezav/gitleaks

[admiralAwkbar]

@massongit @JonZeolla
Hey, this is great. Im not too picky on what tool we use... from a quick look, it seems gitleaks has a much larger following and secretlint

Both do seem to allow us to follow our standard of linting a single file at a time.
Both do offer configuration which is a needed ability in this tool.

Can you guys come to a consensus on which tool we should adopt?

[massongit]

Thank you for your propose!
I didn't know about gitleaks. However, as far as I read it's README, it seems that it is more versatile than secretlint.

[massongit]

I think it might be a good idea to use gitleaks instead of secretlint.

[admiralAwkbar]

@massongit @JonZeolla Awesome guys, we can take this current PR and I can help catch the edges that are missed :)

[JonZeolla]

One thing to keep in mind is any of these tools can be really noisy and generate false positives. I suggest including a minimal, high fidelity configuration to start. I do a lot of tuning of these kind of tools in my day job so I'm happy to review/contribute to that part

[admiralAwkbar]

@massongit @JonZeolla Any help with the .gitleaks.toml file is much appreciated

I think I got most of it done

now for testing

[massongit]

I removed secretlint related code.

[massongit]

@admiralAwkbar

Any help with the .gitleaks.toml file is much appreciated

How about applying the default configuration ( https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml ) ?