feat: reusable secret scanning, SAST, dependency and lint workflows

.forgejo/workflows/secrets.yml

@@ -0,0 +1,34 @@
+# Secret scanning with gitleaks over the repository's full git history.
+#
+# Full history rather than the pushed range: a push range is unreliable on
+# force-pushes and first pushes, and these repos are small enough that a full
+# scan takes seconds. A secret that was committed and later deleted is still
+# exposed, so history is exactly what needs scanning.
+#
+# The calling repo controls what counts as a finding:
+#   .gitleaks.toml     extra rules or allowlists, picked up automatically
+#   .gitleaksignore    fingerprints of accepted findings, one per line, as
+#                      printed in the "Fingerprint:" line of this job's output
+on:
+  workflow_call:
+    inputs:
+      log-opts:
+        description: Extra `git log` options to narrow the scan, e.g. a commit range. Empty scans all history.
+        type: string
+        default: ""
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: gitleaks
+        env:
+          LOG_OPTS: ${{ inputs.log-opts }}
+        run: |
+          gitleaks version
+          set -- git --redact --verbose --no-banner --exit-code 1
+          if [ -n "$LOG_OPTS" ]; then set -- "$@" --log-opts "$LOG_OPTS"; fi
+          gitleaks "$@" .