Add gitleaks secret scanning (CI) (#527)

* Add gitleaks secret scanning (CI)

GitHub native secret scanning and gitleaks' default rules miss NCBO BioPortal
API keys because they are bare UUIDs with no provider prefix, so flagging them
generically would be pure noise. Add gitleaks in CI with the community default
ruleset plus one BioPortal-specific rule keyed on the apikey context. The scan
runs on new commits per PR/push (not full history, which is dominated by
false positives in ontology data).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Fix checkout pin to commit SHA + persist-credentials: false (zizmor)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* gitleaks: handle whitespace around token= and case-insensitive domain

Addresses Copilot review on #527:
- rule 1: allow optional whitespace around 'token =' so 'apikey token = <uuid>'
  is caught (the no-space 'apikey token=<uuid>' form already matched).
- rule 2: add '(?i)' so case variants of the bioontology.org domain are caught.

Validated with gitleaks 8.30.1: all documented BioPortal key forms flagged,
contextless bare UUID not flagged.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: turbomam

.github/workflows/secret-scan.yml

@@ -0,0 +1,57 @@
+name: secret-scan
+
+# Scans NEW commits on every PR and push for committed credentials, using
+# gitleaks with the repo's .gitleaks.toml (default rules + a BioPortal/NCBO
+# API-key rule that GitHub's native secret scanning misses because the key is
+# a bare UUID). This gates new leaks; secrets already in history are handled by
+# rotation, not by failing CI forever, so the scan is limited to the new range.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          set -euo pipefail
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Scan new commits
+        env:
+          EVENT: ${{ github.event_name }}
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+          PUSH_HEAD: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT" = "pull_request" ]; then
+            RANGE="$PR_BASE..$PR_HEAD"
+          elif [ -n "$PUSH_BEFORE" ] && [ "$PUSH_BEFORE" != "0000000000000000000000000000000000000000" ]; then
+            RANGE="$PUSH_BEFORE..$PUSH_HEAD"
+          else
+            RANGE=""
+          fi
+          if [ -n "$RANGE" ]; then
+            echo "Scanning commit range: $RANGE"
+            gitleaks detect --source . --config .gitleaks.toml --redact --no-banner --log-opts="$RANGE"
+          else
+            echo "No prior ref; scanning full tree"
+            gitleaks detect --source . --config .gitleaks.toml --redact --no-banner
+          fi

.gitleaks.toml

@@ -0,0 +1,24 @@
+# Gitleaks configuration for metpo.
+#
+# Extends the built-in ruleset and adds rules for credentials that gitleaks'
+# default rules miss because they are bare UUIDs with no provider prefix. The
+# motivating case: NCBO BioPortal / BioOntology API keys are plain UUIDs
+# (e.g. in a `?apikey=<uuid>` URL or a `BIOPORTAL_API_KEY=<uuid>` assignment).
+# GitHub's native secret scanning and most default rules skip bare UUIDs to
+# avoid false positives, so the only reliable signal is the apikey CONTEXT.
+title = "metpo gitleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "bioportal-ncbo-api-key"
+description = "BioPortal / NCBO BioOntology API key (UUID in an apikey context)"
+regex = '''(?i)(?:bioportal[_-]?(?:api[_-]?key|token)|api[_-]?key|apikey)["'\s:=>]{0,4}(?:token\s*=\s*)?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'''
+keywords = ["apikey", "api_key", "bioportal", "bioontology"]
+
+[[rules]]
+id = "bioportal-ncbo-apikey-url"
+description = "BioPortal / NCBO API key embedded in a bioontology.org URL"
+regex = '''(?i)bioontology\.org[^\s"'<>]*apikey=[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'''
+keywords = ["bioontology"]