feat: add secretlint

.github/workflows/secretlint.yml

@@ -0,0 +1,42 @@
+name: Secretlint
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  test:
+    name: "Secretlint"
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # main
+
+      - name: 🟢 Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # main
+        with:
+          node-version-file: ".tool-versions"
+          cache: "npm"
+
+      - name: 🗄 Cache node_modules
+        id: cache-node_modules
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # main
+        with:
+          path: "**/node_modules"
+          key: node_modules-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
+
+      - name: 🗄 Cache .eslintcache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # main
+        with:
+          path: .eslintcache
+          key: eslintcache-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
+
+      - name: 🔍 Install dependencies
+        if: steps.cache-node_modules.outputs.cache-hit != 'true'
+        run: |
+          npm ci --ignore-scripts --prefer-offline --no-audit
+
+      - name: Lint with Secretlint
+        run: npx secretlint --format github "**/*"

.secretlintrc.json

@@ -0,0 +1,7 @@
+{
+  "rules": [
+    {
+      "id": "@secretlint/secretlint-rule-preset-recommend"
+    }
+  ]
+}

lint-staged.config.js

@@ -1,4 +1,5 @@
 export default {
+  "*": ["secretlint --no-glob"],
   "*.{js,jsx,ts,tsx,html,css,json,json5,md}": ["prettier --write"],
   "!(.github/workflows)/*.{yml,yaml}": ["prettier --write"],
   ".github/workflows/*.{yml,yaml}": [