ci: secret check and dependency check

.github/workflows/lint.yml

@@ -0,0 +1,53 @@
+name: Lint Check
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  checks: write
+
+jobs:
+  git-leaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install gitleaks
+        run: |
+          git clone https://github.com/gitleaks/gitleaks.git
+          cd gitleaks
+          make build
+          cp gitleaks /usr/local/bin/gitleaks
+          cd ..
+          rm -rf gitleaks
+      - name: Run gitleaks
+        run: |
+          /usr/local/bin/gitleaks detect --report-format json
+
+  secret-rip:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+      - run: |
+          cargo install ripsecrets
+          ripsecrets
+
+  dependency-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci
+      - name: Run dependency audit
+        run: npm audit --audit-level moderate