ci: add full-tree secret scanning

.github/workflows/buildah.yml

@@ -5,13 +5,7 @@ on:
   push:
     branches:
       - main
-    paths:
-      - '*/**'
-      - '!.github/**'
   pull_request:
-    paths:
-      - '*/**'
-      - '!.github/**'
   workflow_dispatch:
     inputs:
       mode:
@@ -27,9 +21,32 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install hadolint
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          curl -sSL -o "$HOME/.local/bin/hadolint" \
+            https://github.com/hadolint/hadolint/releases/download/v2.14.0/hadolint-Linux-x86_64
+          chmod +x "$HOME/.local/bin/hadolint"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run pre-commit
+        uses: pre-commit/action@v3.0.1
+        env:
+          SKIP: no-commit-to-branch
+
   detect:
     runs-on: ubuntu-latest
     outputs:
@@ -58,7 +75,10 @@ jobs:
 
   build:
     name: ${{ inputs.mode || 'build & push' }}
-    needs: detect
+    permissions:
+      contents: read
+      packages: write
+    needs: [checks, detect]
     if: needs.detect.outputs.images != '[]'
     runs-on: ubuntu-latest
     strategy:
@@ -69,25 +89,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install buildah, podman, and hadolint
+      - name: Install buildah and podman
         run: |
           sudo apt-get update
           sudo apt-get install -y buildah podman
-          mkdir -p $HOME/.local/bin
-          curl -sSL -o $HOME/.local/bin/hadolint \
-            https://github.com/hadolint/hadolint/releases/download/v2.14.0/hadolint-Linux-x86_64
-          chmod +x $HOME/.local/bin/hadolint
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Run pre-commit
-        uses: pre-commit/action@v3.0.1
-        env:
-          SKIP: no-commit-to-branch
 
       - name: Build image
         uses: redhat-actions/buildah-build@v2

.pre-commit-config.yaml

@@ -14,8 +14,18 @@ repos:
         args: ['--branch', 'main']
       - id: check-added-large-files
         args: ['--maxkb=1000']
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+        entry: gitleaks dir --redact --verbose .
+        pass_filenames: false
   - repo: https://github.com/hadolint/hadolint
     rev: v2.14.0
     hooks:
       - id: hadolint
         args: [--failure-threshold=error]
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint

AGENTS.md

@@ -18,21 +18,23 @@ production publication.
 
 ## Canonical Pre-commit Config
 
-`tfroot-runner/pre-commit-config.yaml` is the source of truth for pre-commit hooks across every `tfroot-*` repo. The runner image pre-caches its hook environments; the shared OpenTofu workflow in `shared-workflows` fetches it at CI time.
+`tfroot-runner/pre-commit-config.yaml` is the source of truth for pre-commit hooks across every `tfroot-*` repo. The runner image pre-caches its hook environments; the shared OpenTofu workflow in `shared-workflows` fetches it at CI time. Secret scanning uses Gitleaks alongside `detect-private-key`.
 
 **Do not** edit `.pre-commit-config.yaml` files in individual `tfroot-*` repos — they pull from here.
 
 ## Build Workflow (`buildah.yml`)
 
-Single workflow, two jobs, both on `ubuntu-latest`.
+Single workflow, three jobs, all on `ubuntu-latest`.
 
-1. **detect** — enumerates which images to build:
+1. **checks** — runs pre-commit, including full-tree Gitleaks scanning,
+   hadolint, and actionlint, for every `main` push, pull request, and manual
+   dispatch.
+2. **detect** — enumerates which images to build:
    - `workflow_dispatch` with `image` input → just that one
    - `workflow_dispatch` with no input → all images (`make list-images-json`)
    - push/PR → only directories changed since the previous commit (`make changed-images`)
-2. **build** — fan-out matrix over the detected list:
-   - install buildah, podman, hadolint
-   - run pre-commit (with `SKIP=no-commit-to-branch` so the hook doesn't block CI)
+3. **build** — after checks pass, fan out over the detected image matrix:
+   - install buildah and podman
    - `redhat-actions/buildah-build@v2` with `--squash`
    - on `push` to `main`, or `workflow_dispatch` with `mode=build & push`, push to GHCR with tags `latest` and `${{ github.sha }}`
 

tfroot-runner/pre-commit-config.yaml

@@ -34,6 +34,12 @@ repos:
       - id: terraform_docs
         args:
           - --args=--config=.terraform-docs.yml
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+        entry: gitleaks dir --redact --verbose .
+        pass_filenames: false
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks: