Add gitleaks pre-commit hook

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.24.3
+    hooks:
+      - id: gitleaks

CONTRIBUTING.md

@@ -6,6 +6,7 @@
   * [Ask for Help](#ask-for-help)
   * [Pull Request Lifecycle](#pull-request-lifecycle)
   * [Development Environment Setup](#development-environment-setup)
+  * [Commit hooks](#commit-hooks)
   * [Sign Your Commits](#sign-your-commits)
   * [Pull Request Checklist](#pull-request-checklist)
 
@@ -61,6 +62,23 @@ You must have a Helm Chart CLI available in your environment to install the char
 
 If you don't have Helm installed yet, please check the official Helm documentation [here](https://helm.sh/docs/helm/helm_install/).
 
+## Commit hooks
+
+This repository uses [pre-commit](https://pre-commit.com/) for local commit hooks, including Gitleaks secret scanning.
+To enable the hooks locally, run from the repo root:
+
+```sh
+$ pre-commit install
+```
+
+To run the Gitleaks hook manually against staged changes:
+
+```sh
+$ pre-commit run gitleaks
+```
+
+If needed, bypass with `SKIP=gitleaks git commit ...` or `git commit --no-verify`.
+
 ## Sign Your Commits
 
 ### CLA