ci(secret-scan): fix gitleaks --source path (docker action host path) (#3)

The docker://zricethezav/gitleaks action mounts the workspace at
/github/workspace, but --source pointed at the host path from
github.workspace ($HOME/runner/work/...), which does not exist inside the
container -> 'stat ...: no such file or directory' on every run.

Follow the 2dph canon (ci.yml secret-scan): install the gitleaks binary
instead of the docker action and scan GITHUB_WORKSPACE - works on both
GitHub and Gitea act runners.

.github/workflows/secret-scan.yml

@@ -34,8 +34,20 @@ jobs:
           echo "Scanning range: $RANGE"
 
       - name: Gitleaks (diff-only, fail on leak)
-        uses: docker://zricethezav/gitleaks:latest
         env:
           GITLEAKS_RANGE: ${{ env.RANGE }}
-        with:
+        run: |
-          args: detect --source "${{ github.workspace }}" --log-opts="$GITLEAKS_RANGE" --redact --verbose
+          set -euo pipefail
+          # install the gitleaks binary (linux-amd64) instead of a docker action:
+          # the docker://zricethezav/gitleaks action hardcodes /github/workspace,
+          # which does not exist on the Gitea (act) runner. $GITHUB_WORKSPACE is the
+          # checkout dir on BOTH runners (GitHub and Gitea act).
+          curl -fsSLo /tmp/gitleaks.tar.gz \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+          chmod +x /tmp/gitleaks
+          /tmp/gitleaks detect \
+            --source "$GITHUB_WORKSPACE" \
+            --log-opts="$GITLEAKS_RANGE" \
+            --redact \
+            --verbose