security: add GitHub Actions secret scanning and hardening docs #1

	name: Secret Scan

	on:
	push:
	branches: [main, master]
	pull_request:
	branches: [main, master]

	jobs:
	trufflehog:
	name: TruffleHog Secret Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Run TruffleHog
	uses: trufflesecurity/trufflehog@main
	with:
	path: ./
	base: main
	head: HEAD
	extra_args: --only-verified

	forbidden-files:
	name: Forbidden File Check
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Check for forbidden files
	run: \|
	FORBIDDEN=(".env" ".env.local" ".env.production" ".env_example" "docker-compose.production.yml" "var/secret_key.txt")
	EXIT=0
	for f in "${FORBIDDEN[@]}"; do
	if [ -f "$f" ]; then
	echo "FORBIDDEN FILE DETECTED: $f"
	EXIT=1
	fi
	done
	if [ $EXIT -ne 0 ]; then
	echo ""
	echo "These files contain secrets and must not be committed."
	echo "Add them to .gitignore and remove them from the repository."
	exit 1
	fi
	echo "No forbidden files detected."

Provide feedback