chore(ci): add gitleaks scan

.github/workflows/gitleaks-scan-on-pr.yml

@@ -0,0 +1,21 @@
+name: Gitleaks Pull Request Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  gitleaks_scan:
+    name: Gitleaks scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Run Gitleaks diff scan
+        uses: deckhouse/modules-actions/gitleaks@v6
+        with:
+          scan_mode: "diff"

.github/workflows/gitleaks-scan-on-schedule.yml

@@ -0,0 +1,23 @@
+name: Gitleaks Daily Scan
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  gitleaks_scan:
+    name: Gitleaks scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Run Gitleaks diff scan
+        uses: deckhouse/modules-actions/gitleaks@v6
+        with:
+          scan_mode: "full"

.gitleaks.toml

@@ -0,0 +1,14 @@
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Allowlist for virtualization repo to ignore specific test folders"
+paths = [
+  # test files and data
+  '''testdata/''',
+  '''^test/''',
+  '''_test\.go$''',
+  '''^images/packages/.+/README\.md$''',
+  # development files that are not used in production images
+  '''^images/kube-api-rewriter/local/''',
+]