From d18586de73c3a6a7b3130d65cce3b4ea7e2c5886 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Mon, 2 Nov 2026 00:09:45 +0800
Subject: [PATCH] ci(security): add org secret scan and pre-publish guard

Pin the shared QuantStrategyLab/.github scan at 0da4da68 and scan data-branch content before push.
---
 .github/workflows/required-gitleaks.yml | 15 +++++++++++++++
 .github/workflows/weekly-gitleaks.yml   | 17 +++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 .github/workflows/required-gitleaks.yml
 create mode 100644 .github/workflows/weekly-gitleaks.yml

diff --git a/.github/workflows/required-gitleaks.yml b/.github/workflows/required-gitleaks.yml
new file mode 100644
index 0000000..16f0fc8
--- /dev/null
+++ b/.github/workflows/required-gitleaks.yml
@@ -0,0 +1,15 @@
+# Keep the shared ref pinned to a reviewed full commit SHA.
+name: Required secret scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    uses: QuantStrategyLab/.github/.github/workflows/gitleaks.yml@0da4da68433b803cda17d3f84e29875a94a32273
diff --git a/.github/workflows/weekly-gitleaks.yml b/.github/workflows/weekly-gitleaks.yml
new file mode 100644
index 0000000..5eb2bfa
--- /dev/null
+++ b/.github/workflows/weekly-gitleaks.yml
@@ -0,0 +1,17 @@
+# Keep the shared ref pinned to a reviewed full commit SHA.
+name: Weekly all-branch secret scan
+
+on:
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    uses: QuantStrategyLab/.github/.github/workflows/gitleaks.yml@0da4da68433b803cda17d3f84e29875a94a32273
+    with:
+      full-history: true