Rewrite CI/CD pipeline

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

.github/workflows/secrets.yaml

@@ -11,12 +11,15 @@ permissions:
 
 jobs:
   scan:
-    runs-on: "ubuntu-latest"
+    runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache"
+    permissions:
+      contents: "read"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
         with:
           fetch-depth: 0
           submodules: recursive
+      - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2
       - uses: "trufflesecurity/trufflehog@e48f9039c82786db50685e8ef7d980b209f06186" # main
         with:
           extra_args: "--results=verified,unknown --exclude-paths=.trufflehog-exclude"