[CameronBrooks11]

What

The Scan step now also scans each merge commit's own diff.

Why

git log -p shows no diff for a merge commit. A secret introduced only in a merge resolution, so present in neither parent, was never scanned. Those merges are evil merges or hand-resolved conflicts.

How

--log-opts replaces gitleaks' default git-log options. The new value keeps those defaults and adds --diff-merges=first-parent. gitleaks' debug log shows the commands it runs:

• default: git log -p -U0 --full-history --all --diff-filter=tuxdb
• with this change: git log -p -U0 --all --full-history --diff-merges=first-parent --diff-filter=tuxdb

Testing

• New tests/gitleaks-scan.test.sh runs the step's exact run: block with 4 cases: a clean repo, an ordinary commit, a merge-only token, and a token on a non-HEAD branch. All 4 pass.
• Against main's workflow only the merge-only case fails (exit 0, "no leaks found"). The other three are unchanged.
• Across the full history of every FlowMatrix-AI repo (71 repos, 433 merge commits), finding counts are identical with and without this change. Total scan time was 59 s for both runs together.
• The repo's own history scans clean with the new options.

#39 changes ci.yml to run every tests/*.test.sh, so this test runs in CI whichever of the two PRs merges first.