Chore: [AEA-0000] - use gitleaks for secret scanning

[anthony-nhs]

use gitleaks for secret scanning

[Copilot]

Pull request overview

Updates pre-commit secret scanning to use gitleaks instead of git-secrets.

Changes:

• Replace the local git-secrets pre-commit hook with a gitleaks hook invocation.
• Remove the .gitallowed allowlist file that was used with git-secrets.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.pre-commit-config.yaml	Swaps secret-scanning hook to run gitleaks during pre-commit.
.gitallowed	Removes the git-secrets allowlist file now that git-secrets is no longer used.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

pass_filenames is omitted for this local hook. Since the command already determines what to scan via --staged (and all other local hooks in this file set pass_filenames: false), pre-commit will append a potentially large list of filenames to the bash -c invocation, which can hit OS arg length limits and is unnecessary. Add pass_filenames: false to this hook for consistency and to avoid oversized command lines.

Suggested change

	language: system
	language: system
	pass_filenames: false

[Copilot]

The hook description appears to be carried over from git-secrets (mentions scanning commit messages and --no-ff merges). Gitleaks’ pre-commit integration generally scans content (e.g., staged changes), not commit messages, so this description is misleading; update it to accurately reflect what this hook actually checks.

Suggested change

	description: gitleaks scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
	description: gitleaks scans staged changes for secrets before they are committed to the repository.