chore: add detect-secrets scanning

.github/workflows/secret-scan.yml

@@ -0,0 +1,30 @@
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 3 * * 0'
+
+jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install detect-secrets
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install detect-secrets
+
+      - name: Run secret detection
+        run: ./scripts/ci/secret-detection.sh

.gitignore

@@ -53,6 +53,9 @@ nosetests.xml
 coverage.xml
 *,cover
 .pytest_cache
+.pre-commit-cache/
+.uv-cache/
+.uvcache/
 
 # Translations
 *.mo

.pre-commit-config.yaml

@@ -0,0 +1,11 @@
+repos:
+  - repo: local
+    hooks:
+      - id: detect-secrets
+        name: Detect secrets
+        entry: ./scripts/pre-commit-secret-check.sh
+        language: python
+        additional_dependencies:
+          - detect-secrets
+        pass_filenames: false
+        always_run: true