feat(gitleaks): introduce local secret scanning and redaction using Gitleaks

.github/workflows/lint.yml

@@ -67,10 +67,29 @@ jobs:
             ~/.cargo/git/db/
             collect-diff-context-cli/target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('collect-diff-context-cli/Cargo.lock') }}
+      - name: Fetch pinned Gitleaks binary
+        run: ./scripts/fetch_gitleaks.sh --platform linux-amd64
+      - name: Verify Gitleaks trust chain
+        run: ./install.sh --doctor
+      - name: Build current helper source
+        run: |
+          cargo build --release --manifest-path collect-diff-context-cli/Cargo.toml
+          echo "PRE_COMMIT_REVIEW_RUST_BIN=$GITHUB_WORKSPACE/collect-diff-context-cli/target/release/collect-diff-context-cli" >> "$GITHUB_ENV"
       - name: Run collect_diff_context_test.sh
         run: ./tests/collect_diff_context_test.sh
       - name: Run parity_golden_test.sh
         run: ./tests/parity_golden_test.sh
+      - name: Run secret_gate_test.sh
+        run: ./tests/secret_gate_test.sh
+      - name: Run gitleaks_distribution_test.sh
+        run: ./tests/gitleaks_distribution_test.sh
+      - name: Run install_gitleaks_test.sh
+        run: ./tests/install_gitleaks_test.sh
+      - name: Run output quality comparison self-test
+        run: |
+          ./evals/output_eval_runner_test.sh
+          ./evals/compare_output_eval_quality_test.sh
+          ./evals/eval_contract_test.sh
       - name: Validate JSON schemas
         run: |
           pip install jsonschema

.github/workflows/release.yml

@@ -20,19 +20,23 @@ jobs:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-musl
             artifact_name: collect_diff_context-linux-amd64
+            gitleaks_platform: linux-amd64
             use_musl: true
 
           - os: macos-latest
             target: aarch64-apple-darwin
             artifact_name: collect_diff_context-darwin-arm64
+            gitleaks_platform: darwin-arm64
 
           - os: macos-13
             target: x86_64-apple-darwin
             artifact_name: collect_diff_context-darwin-amd64
+            gitleaks_platform: darwin-amd64
 
           - os: windows-latest
             target: x86_64-pc-windows-msvc
             artifact_name: collect_diff_context-windows-amd64.exe
+            gitleaks_platform: windows-amd64
 
     steps:
       - name: Checkout repository
@@ -61,11 +65,15 @@ jobs:
             cp collect-diff-context-cli/target/${{ matrix.target }}/release/collect-diff-context-cli dist/${{ matrix.artifact_name }}
           fi
 
+      - name: Fetch pinned Gitleaks binary
+        shell: bash
+        run: ./scripts/fetch_gitleaks.sh --platform "${{ matrix.gitleaks_platform }}" --dest dist
+
       - name: Upload Build Artifact
         uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.artifact_name }}
-          path: dist/${{ matrix.artifact_name }}
+          path: dist/*
 
   create-release:
     name: Create GitHub Release
@@ -81,13 +89,27 @@ jobs:
         with:
           path: artifacts
 
+      - name: Build self-contained skill package
+        shell: bash
+        run: |
+          mkdir -p dist/pre-commit-review
+          cp SKILL.md LICENSE dist/pre-commit-review/
+          cp -R agents references scripts THIRD_PARTY_LICENSES dist/pre-commit-review/
+          find artifacts -type f -name 'collect_diff_context-*' -exec cp {} dist/pre-commit-review/scripts/bin/ \;
+          find artifacts -type f -name 'gitleaks-*' -exec cp {} dist/pre-commit-review/scripts/bin/ \;
+          chmod +x dist/pre-commit-review/scripts/collect_diff_context.sh
+          chmod +x dist/pre-commit-review/scripts/check_gitleaks.sh
+          chmod +x dist/pre-commit-review/scripts/bin/collect_diff_context-* || true
+          chmod +x dist/pre-commit-review/scripts/bin/gitleaks-* || true
+          dist/pre-commit-review/scripts/check_gitleaks.sh
+          tar -czf dist/pre-commit-review-runtime.tar.gz -C dist pre-commit-review
+
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
           files: |
-            artifacts/collect_diff_context-linux-amd64/collect_diff_context-linux-amd64
-            artifacts/collect_diff_context-darwin-arm64/collect_diff_context-darwin-arm64
-            artifacts/collect_diff_context-darwin-amd64/collect_diff_context-darwin-amd64
-            artifacts/collect_diff_context-windows-amd64.exe/collect_diff_context-windows-amd64.exe
+            artifacts/**/collect_diff_context-*
+            artifacts/**/gitleaks-*
+            dist/pre-commit-review-runtime.tar.gz
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -24,5 +24,8 @@ __pycache__/
 target/
 *.rs.bk
 
+# Release-staged third-party binaries
+scripts/bin/gitleaks-*
+
 # superpowers
-docs/superpowers/
+docs/superpowers/