Align security gates with intentproof-tools template

Use gitleaks-action, local allowlist script, and tools ref
552da9d for javascript custom queries where applicable.

Signed-off-by: Nathan Gillett <nathan@intentproof.io>

Author: Nathan Gillett

.github/workflows/codeql.yml

@@ -1,37 +1,42 @@
 name: codeql
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
   schedule:
     - cron: "0 6 * * 1"
+
 permissions:
   actions: read
   contents: read
   security-events: write
+
 jobs:
   allowlist-expiry:
     name: "IntentProof Security: CodeQL Allowlist"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - run: bash ./scripts/check-codeql-allowlist.sh
+
+      - name: Validate allowlist expiry dates
+        run: bash ./scripts/check-codeql-allowlist.sh
+
   gitleaks:
     name: "IntentProof Security: Secret Scan"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Install gitleaks
-        run: |
-          curl -sSfL \
-            "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz" \
-            | tar -xz
-          sudo mv gitleaks /usr/local/bin/
+
       - name: Run gitleaks
-        run: gitleaks detect --source . --config .gitleaks.toml --verbose --redact
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_CONFIG: .gitleaks.toml
+
   analyze:
     name: "IntentProof Security: CodeQL (${{ matrix.language }})"
     needs: allowlist-expiry
@@ -42,14 +47,21 @@ jobs:
         language: [python]
     steps:
       - uses: actions/checkout@v4
+
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
-      - run: pip install -e ".[dev]"
-      - uses: github/codeql-action/init@v3
+          python-version: "3.11"
+
+      - name: Install package for CodeQL
+        run: pip install -e ".[dev]"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{ matrix.language }}"

.gitleaks.toml

@@ -10,20 +10,11 @@ useDefault = true
 description = "Global allowlist paths for false positives"
 paths = [
   '''\.git/''',
-  '''coverage\.out''',
   '''\.coverage''',
-  '''package-lock\.json''',
-  '''go\.sum''',
-  '''codeql-pack\.lock\.yml''',
-  '''keys/intentproof-security\.asc''',
-  '''keys/intentproof-security\.fingerprint\.json''',
-  '''golden/''',
-  '''fixtures/''',
+  '''tests/fixtures/''',
 ]
-# Example test vectors and documentation placeholders only.
-regexTarget = "line"
+
+[allowlist.regexTarget]
 regexes = [
   '''EXAMPLE|PLACEHOLDER|REDACTED|xxxxxxxx''',
-  '''Ed25519(?:Private|Public)Key''',
-  '''_instance_private_key''',
 ]