[nstranquist]

Outcome

Pull requests and pushes to main run a dedicated gitleaks scan. The scan has no path filter, so a docs-only change is still scanned. A manual workflow_dispatch run scans full history. The workflow token can read repository contents and pull requests only.

Safety review

• The change does not stash, reset, clean, force-update, merge, or push.
• Concurrent index, ref, lock, path, hook, and crash behavior was considered.
• New state has a bounded and fail-closed reader.
• Tests cover the failure boundary.

This change does not touch capture, state, or hooks. The scan fails the job when gitleaks reports a leak. There is no secret-string allowlist and no pre-commit hook.

Verification

Local, before this pull request:

• gitleaks 8.30.1 detect over 162 commits: no leaks.
• gitleaks 8.30.1 dir: no leaks.
• No .gitleaks.toml or .gitleaksignore: the history and worktree had no generated or vendor false positives.
• go test ./...
• go test -race -count=3 ./... (the cmd/wip and internal/store packages needed -timeout 45m on this host; both passed)
• go vet ./...
• actionlint 1.7.12

The workflow matches the approved pack from nstranquist/crypto-scan#30 (cursor/gitleaks-ci-dacd), with persist-credentials: false on checkout so the job does not leave the token in the git config.

Hosted, head a4ffed039df05a59b1999d3a7ccd8d336da2d8bd:

• gitleaks check conclusion: success. Run https://github.com/nstranquist/wip-commit/actions/runs/41557739218
• The job scanned. It ran gitleaks 8.30.1 detect on a269d079daeb728b7caa37c0cc6ebd4f52908e5e^..a4ffed039df05a59b1999d3a7ccd8d336da2d8bd, reported 2 commits scanned and no leaks found, and skipped comments. The log has no pulls API 403.
• gitleaks-full-history was skipped on the pull request, as required.
• Linux, macOS, Windows, race, lint, and dependency review passed.

Do not merge.