feat: add secretlint

.github/workflows/lint-github-actions.yml

@@ -18,7 +18,7 @@ permissions: {}
 
 jobs:
   lint-github-actions:
-    name: 🌈 zizmor
+    name: 🔍 Lint GitHub Actions
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/lint-secrets.yml

@@ -0,0 +1,39 @@
+name: 🔍 Lint Secrets
+
+on:
+  push:
+    branches:
+      - main
+      - beta
+  pull_request: {}
+  workflow_dispatch: {}
+
+permissions: {}
+
+jobs:
+  lint-secrets:
+    name: 🔍 Lint Secrets
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # main
+        with:
+          persist-credentials: false
+
+      - name: 🔍 Run secretlint
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          secretlint_version="$(node -p "require('./package.json').devDependencies.secretlint")"
+          secretlint_version="${secretlint_version#^}"
+          secretlint_version="${secretlint_version#~}"
+          secretlint_version="${secretlint_version#v}"
+
+          docker run --rm --network none \
+            -v "${PWD}:${PWD}" -w "${PWD}" \
+            "secretlint/secretlint:v${secretlint_version}" \
+            secretlint --format github "**/*"

.secretlintrc.json

@@ -0,0 +1,7 @@
+{
+  "rules": [
+    {
+      "id": "@secretlint/secretlint-rule-preset-recommend"
+    }
+  ]
+}

lint-staged.config.js

@@ -1,4 +1,5 @@
 export default {
+  "*": ["secretlint --no-glob"],
   "*.{js,jsx,ts,tsx,html,css,json,json5,md}": ["prettier --write"],
   "!(.github/workflows)/*.{yml,yaml}": ["prettier --write"],
   ".github/workflows/*.{yml,yaml}": [