security: classify channel keys and baseline reviewed findings

.github/workflows/ci.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches: ['**']
   pull_request:
+  schedule:
+    - cron: '17 4 * * *'
 
 permissions:
   contents: read
@@ -14,6 +16,7 @@ concurrency:
 
 jobs:
   backend:
+    if: github.event_name != 'schedule'
     name: Backend
     runs-on: ubuntu-latest
     services:
@@ -62,6 +65,7 @@ jobs:
       - run: npm run build
 
   frontend:
+    if: github.event_name != 'schedule'
     name: Frontend
     runs-on: ubuntu-latest
     defaults:
@@ -81,6 +85,7 @@ jobs:
       - run: npm run build
 
   workers-and-compose:
+    if: github.event_name != 'schedule'
     name: Workers and Compose
     runs-on: ubuntu-latest
     env:
@@ -407,3 +412,7 @@ jobs:
         uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: 8.30.0
+      - name: Scan full repository history on push and pull request
+        if: github.event_name != 'schedule'
+        run: gitleaks git --redact --no-banner --log-opts=--all