chore: add gitleaks secret-scan workflow and fix .env.example provider vars

[jithin23-kv]

What

• Adds a Secret Scan GitHub Actions workflow running gitleaks/gitleaks-action@v2 on pushes/PRs to master (uses the existing tuned .gitleaks.toml).
• Fixes .env.example: the OpenAI-compatible section referenced provider: "other" and CUSTOM_LLM_API_KEY, but the code (core/src/providers/factory.ts) uses provider id openai-compatible and env var OPFOR_API_KEY.

Why

A tuned .gitleaks.toml existed but no workflow ran it — nothing scanned PRs for committed secrets. The .env.example drift is a first-run papercut that sends new users to the wrong variable.

Verified

npm run typecheck, npm run lint, npm run format:check all pass; committed with the full pre-commit hook (incl. gitleaks, 0 leaks), no --no-verify.

Summary by CodeRabbit

• Documentation
  • Updated the example environment configuration to reflect the current OpenAI-compatible setup and revised the suggested API key placeholder.
• Chores
  • Added an automated secret-scanning check to help catch sensitive information in pull requests and pushes.

[coderabbitai]

Warning

Review limit reached

@jithin23-kv, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f6e0a1b9-b310-4618-a15b-80d5e48dafa7

📥 Commits

Reviewing files that changed from the base of the PR and between e4098e0 and 93b42bf.

📒 Files selected for processing (1)

• .github/workflows/secret-scan.yml

Walkthrough

A new GitHub Actions Secret Scan workflow is added using gitleaks to scan for secrets on PRs and pushes to master/main. The .env.example OpenAI-compatible endpoints section updates the provider name from "other" to "openai-compatible" and replaces the CUSTOM_LLM_API_KEY placeholder with OPFOR_API_KEY.

Changes

Secret Scan CI and Config Update

Layer / File(s)	Summary
Gitleaks secret scan workflow .github/workflows/secret-scan.yml	Adds a Secret Scan workflow triggered on PRs and pushes to master/main, checking out full history and running gitleaks/gitleaks-action@v2 with GITHUB_TOKEN and GITLEAKS_LICENSE.
OpenAI-compatible env example update .env.example	Changes provider from "other" to "openai-compatible" and replaces the CUSTOM_LLM_API_KEY placeholder with OPFOR_API_KEY.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main changes: adding a gitleaks workflow and aligning .env.example provider vars.
Description check	✅ Passed	The description covers the problem, solution, changes, and verification, but it does not follow the template headings and omits Issue/Screenshots.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/ci-and-env-hygiene

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/secret-scan.yml (1)

14-16: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable checkout credential persistence.

actions/checkout writes the token into the local git config by default. In this job that is redundant because the next step already gets GITHUB_TOKEN via env, so keeping persisted git credentials only broadens the token exposure surface.

Suggested fix

       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/secret-scan.yml around lines 14 - 16, The checkout step in
the secret-scan workflow is persisting credentials unnecessarily, widening token
exposure. Update the existing actions/checkout@v4 step to disable credential
persistence while keeping the current fetch-depth behavior; use the checkout
configuration in this job so the later step continues to rely on GITHUB_TOKEN
via env without writing it into local git config.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/secret-scan.yml:
- Around line 14-16: The checkout step in the secret-scan workflow is persisting
credentials unnecessarily, widening token exposure. Update the existing
actions/checkout@v4 step to disable credential persistence while keeping the
current fetch-depth behavior; use the checkout configuration in this job so the
later step continues to rely on GITHUB_TOKEN via env without writing it into
local git config.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6620b37b-b344-49f2-8fc9-355941900ef9

📥 Commits

Reviewing files that changed from the base of the PR and between 55596b3 and e4098e0.

📒 Files selected for processing (2)

• .env.example
• .github/workflows/secret-scan.yml