ci: use gitleaks CLI for secret scan

Author: Zachary-wW

.github/workflows/secrets.yml

@@ -20,7 +20,25 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.30.1
+          ARCHIVE="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          CHECKSUMS="gitleaks_${GITLEAKS_VERSION}_checksums.txt"
+          BASE_URL="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+
+          curl -sSLO "${BASE_URL}/${ARCHIVE}"
+          curl -sSLO "${BASE_URL}/${CHECKSUMS}"
+          grep "${ARCHIVE}" "${CHECKSUMS}" | sha256sum -c -
+          tar -xzf "${ARCHIVE}" gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+
+      - name: Run gitleaks on PR commits
+        if: github.event_name == 'pull_request'
+        run: |
+          gitleaks git --log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" --verbose --redact
+
+      - name: Run gitleaks on repository history
+        if: github.event_name != 'pull_request'
+        run: |
+          gitleaks git --verbose --redact