From bc222eef8b4838aef94366b05001c9695bdfe23c Mon Sep 17 00:00:00 2001
From: Prem Kumar Akula <premkumar.akula@sambanovasystems.com>
Date: Thu, 23 Jul 2026 16:56:17 -0500
Subject: [PATCH] [CLOUD-4610] Add gitleaks secret scanning

---
 .circleci/config.yml | 11 +++++++++++
 .gitleaks.toml       |  5 +++++
 2 files changed, 16 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 14333486..8c2bf618 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -21,6 +21,16 @@ executors:
 
 # Define the jobs we want to run for this project
 jobs:
+  gitleaks:
+    executor: base
+    steps:
+      - checkout
+      - run:
+          name: Install and run gitleaks (non-blocking)
+          command: |
+            VERSION=8.28.0
+            curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" | tar -xz gitleaks
+            ./gitleaks detect --source . --redact -v --config .gitleaks.toml || echo "gitleaks reported findings (non-blocking during rollout)"
   pre-commit:
     executor: pip-tools-docker
     steps:
@@ -180,6 +190,7 @@ workflows:
     jobs:
       - pre-commit
       - test
+      - gitleaks
   build-test-publish:
     jobs:
       - pre-commit:
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 00000000..2d9e54ec
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,5 @@
+# Gitleaks config for generative_data_prep. Extends the built-in default ruleset.
+title = "generative_data_prep gitleaks config"
+
+[extend]
+useDefault = true