SECOPS-2268: Add Gitleaks to CI

[svc-secops]

Motivation / Implements

This PR adds the necessary files to configure Gitleaks to run on PRs on this repo. The Apollo Security team uses Gitleaks to test our repositories for secrets.

Once this is accepted and merged, the Security team plans to make a passing Gitleaks check a requirement for PRs to merge into this repo. This will prevent secrets from being introduced to our repos.

In the event that a secret is detected on a repo, the CI job will add a comment to the PR associated with the detection to provide instructions on how to properly resolve the detection. Additionally, if a secret is detected, the Apollo Security team will be notified so that we can be available to assist in resolving the detection.

If maintainers reviewing this PR have questions, please see this Apollo-internal Slack link.

Changed

• Added .circleci/config.yml to this repo. This file contains appropriate configuration to enable Gitleaks as a CI check.

[fbartho]

Hi @svc-secops — can you please have a human in Apollo’s chain of command verify you’re a legitimate bot account and that this PR is legit?

I have no objections, but I have no way to verify your credentials at this time. There have been fake dependabot PRs lately that try to hack into popular repos, so I need either a page on Apollo’s sites that affirms you’re a legit bot, or a personal communication from somebody I can verify is authorized to sign-off on your changes.

Thanks!

[peakematt]

Hi @fbartho This PR was generated by me via the svc-secops creds! 😄

[fbartho]

Thanks @peakematt! Silly question, but do you have any explanation for me about this? #313 (comment)

[peakematt]

@fbartho If #313 caused problems, I'm so sorry! We've been working to get Renovate running on our repos in a more uniform way and with a wider implementation. I think perhaps the instance of Renovate we're using saw the existing Renovate config file on the repo and ran with it? We have a slightly more opinionated Renovate config set as the default than the Renovate Github app uses. I'm happy to help revert that PR, disable Renovate from running on this repo, and/or help migrate the repo to the Renovate Github app if you'd like!