feat: add secretlint

[niklashaug]

closes #69

This introduces secretlint into the template, running both locally in the pre-commit hook as well as in GitHub Actions.

[Copilot]

Pull request overview

This PR adds Secretlint-based secret scanning to the template to catch leaked credentials both before commits (via lint-staged) and in CI (via a dedicated GitHub Actions workflow), addressing #69’s request for an npm-installable alternative to tools like gitleaks.

Changes:

• Add secretlint and the recommended preset to devDependencies.
• Run Secretlint in the pre-commit pipeline via lint-staged.
• Add .secretlintrc.json and a new GitHub Actions workflow to run Secretlint in CI.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Adds Secretlint and its recommended rules preset as dev dependencies.
package-lock.json	Locks Secretlint and transitive dependencies for reproducible installs.
lint-staged.config.js	Runs Secretlint on staged files as part of pre-commit checks.
.secretlintrc.json	Introduces the Secretlint configuration using the recommended preset.
.github/workflows/secretlint.yml	Adds a CI workflow to run Secretlint on pushes/PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[niklashaug]

I still need to test locally if I get an error when trying to commit a secret. I just did that but got no error. Not sure whether the pre-commit hooks actually run. All I need for Husky is to npm install, right?

Edit: works now, my commit gets rejected when I try to add credentials.

[jhnns]

Thanks @niklashaug

I refactored the GitHub action a little bit to not install all npm dependencies again as this can get quite large in bigger projects. We now use the Docker image based on the package.json version. I also aligned it a little bit with #78

I made a test commit locally (it got rejected ✅) and also pushed it via --no-verify: the GitHub action failed as expected.