gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.
scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.
tanshu