Integrate gitleaks to prevent adding secret

.github/workflows/gitleaks.yml

@@ -0,0 +1,14 @@
+name: 💧
+on: [pull_request, push, workflow_dispatch]
+jobs:
+  gitleaks:
+    timeout-minutes: 15
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@e6dab246340401bf53eec993b8f05aebe80ac636 # v2.3.4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Makefile.toml

@@ -24,6 +24,7 @@ script = [
   "deno lint",
   "typos . .github .vscode",
   "actionlint",
+  "gitleaks detect",
 ]
 
 [tasks.test]
@@ -77,6 +78,7 @@ script = [
   "jq --version",
   "jnv --version",
   "pinact --version",
+  "gitleaks version",
 ]
 
 [tasks.check_no_git_diff]

flake.nix

@@ -43,6 +43,7 @@
               gh
               jq
               edge-pkgs.jnv
+              gitleaks
             ];
           };