chore(hooks): add gitleaks secret scan to pre-commit
Run 'gitleaks protect --staged' before prettier in the pre-commit hook. The gitleaks binary comes from the @nogoo9/gitleaks devDependency, which ships official binaries as platform optionalDependencies - no postinstall scripts, so it installs under ignore-scripts=true. Falls back to a system gitleaks, and soft-skips with a hint to run 'npm i' on a fresh clone rather than blocking the commit.
This commit is contained in:
dc committed
1 parent
82a45b80b4
commit
b3b9755aa7
3 files changed
+174
-2
No files matched your search
@@ -3,6 +3,26 @@
|
||||
# Using `--silent` helps for showing any errs in the first line of the response
|
||||
# The first line is picked up by the VS Code GIT UI popup when rc is not 0
|
||||
|
||||
# Scan staged changes for secrets before anything else runs.
|
||||
# The pinned binary comes from the @nogoo9/gitleaks devDependency
|
||||
# (installed into node_modules/.bin by npm i); a system gitleaks is used
|
||||
# as a fallback so commits are not blocked on a fresh clone.
|
||||
if [ -x node_modules/.bin/gitleaks ]; then
|
||||
gitleaks_bin=node_modules/.bin/gitleaks
|
||||
else
|
||||
gitleaks_bin=$(command -v gitleaks 2> /dev/null)
|
||||
fi
|
||||
|
||||
if [ -n "$gitleaks_bin" ]; then
|
||||
if ! "$gitleaks_bin" protect --staged --redact; then
|
||||
echo "❌ gitleaks detected a potential secret in your staged changes"
|
||||
echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "⚠ gitleaks not found - run 'npm i' to install it (secrets scan skipped)"
|
||||
fi
|
||||
|
||||
if npm run --silent lint:check:silent ; then
|
||||
exit 0
|
||||
else
|
||||
|
||||
Generated
+153
-2
@@ -1,14 +1,15 @@
|
||||
{
|
||||
"name": "dcfrontend",
|
||||
"version": "7.12.0",
|
||||
"version": "7.14.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "dcfrontend",
|
||||
"version": "7.12.0",
|
||||
"version": "7.14.0",
|
||||
"hasInstallScript": true,
|
||||
"devDependencies": {
|
||||
"@nogoo9/gitleaks": "8.30.1-post.2",
|
||||
"@saithodev/semantic-release-gitea": "^2.1.0",
|
||||
"@semantic-release/changelog": "^6.0.3",
|
||||
"@semantic-release/commit-analyzer": "13.0.1",
|
||||
@@ -119,6 +120,156 @@
|
||||
"node": ">= 8"
|
||||
}
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks/-/gitleaks-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-WkQPfryKH8w9DEqJ1Bxw3ex9aXl0M8cxDDt1ATvyieaMvWiGamGXHNLZaJeqECInVfxNPEiZA4Few8Uwtuj1wQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"bin": {
|
||||
"gitleaks": "src/index.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18"
|
||||
},
|
||||
"optionalDependencies": {
|
||||
"@nogoo9/gitleaks-darwin-arm64": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-darwin-x64": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-linux-arm": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-linux-arm64": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-linux-x32": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-linux-x64": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-windows-arm64": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-windows-x32": "8.30.1-post.2",
|
||||
"@nogoo9/gitleaks-windows-x64": "8.30.1-post.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-darwin-arm64": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-darwin-arm64/-/gitleaks-darwin-arm64-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-3j1zSvCKY7N4RnSl+oJrnrLZAY6HihD3uyi32qYrdIXH5hgVjmKiJhvGyoaV7DNw/4NdN3UsadrTM1u5M7iCuw==",
|
||||
"cpu": [
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"darwin"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-darwin-x64": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-darwin-x64/-/gitleaks-darwin-x64-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-EbWRmrWdwRtzfO4ivYXA2ZKcf4aqVZFGQVu2HJjCFjRNryyMfou4Hw3tdZc5tRbdSE0yiwaAXJ8lPazApd3iGQ==",
|
||||
"cpu": [
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"darwin"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-linux-arm": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-linux-arm/-/gitleaks-linux-arm-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-a5aZc5WQnBmNz5CCOPd0MT75csSBUEYMEVIHR6p56TOt4lj8h+IeQ5VTKG+f9j9nU+hmG2e//j4hLcbZZkCspw==",
|
||||
"cpu": [
|
||||
"arm"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"linux"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-linux-arm64": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-linux-arm64/-/gitleaks-linux-arm64-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-XJzvhOEsqr6nJrBuLzDb+qBfdLjssKv/7gqQNhojd8LPM0/aEiC380kYuM9mFCXF3o3PpD4IXv/Jvemw5JJQGA==",
|
||||
"cpu": [
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"linux"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-linux-x32": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-linux-x32/-/gitleaks-linux-x32-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-d20jRC6HCzc9J79Ti8JHFc3X3iJktF78NaUEg0EPGLHRsVpxVObtiCQAJzCgH0uXNMOVFrnsf/+dSDFwjTLU9Q==",
|
||||
"cpu": [
|
||||
"ia32"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"linux"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-linux-x64": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-linux-x64/-/gitleaks-linux-x64-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-GSJ7RU0xuaF9Blf2AmDeytxyiZb4W7/Urd5Cw5LlNK+IF/C+Nd/Fp5pKbaAF4osdxADbCZ7d4XMYUMSdlpjQFA==",
|
||||
"cpu": [
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"linux"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-windows-arm64": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-windows-arm64/-/gitleaks-windows-arm64-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-cTu+rMASv3BuNJcPj57PhfiOHwapmOVH6s5PFBqAXzJomUnHdB/ZMrTDNseW78UZQQ/c0RPI3VXwieyMC23w7w==",
|
||||
"cpu": [
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"win32"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-windows-x32": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-windows-x32/-/gitleaks-windows-x32-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-MGMtKVEOf0TsXIGBu/1eGb94mAZRX2rzZmgNRYqzZBSYPnmyl3w1n4tic9e6rPOewyGfuxnweCDnu0Lu/qkaaw==",
|
||||
"cpu": [
|
||||
"ia32"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"win32"
|
||||
]
|
||||
},
|
||||
"node_modules/@nogoo9/gitleaks-windows-x64": {
|
||||
"version": "8.30.1-post.2",
|
||||
"resolved": "https://registry.npmjs.org/@nogoo9/gitleaks-windows-x64/-/gitleaks-windows-x64-8.30.1-post.2.tgz",
|
||||
"integrity": "sha512-whDUUm3+J5YRQUJS0mcE72JaPb2N0Njmjaj6NYTcG1OJS3v42Y/JYen6R9FuQ5jUCfsVGcblmSBmDb9uZVdwrw==",
|
||||
"cpu": [
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"win32"
|
||||
]
|
||||
},
|
||||
"node_modules/@pnpm/config.env-replace": {
|
||||
"version": "1.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@pnpm/config.env-replace/-/config.env-replace-1.1.0.tgz",
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
"version": "7.14.0",
|
||||
"description": "Data Controller",
|
||||
"devDependencies": {
|
||||
"@nogoo9/gitleaks": "8.30.1-post.2",
|
||||
"@saithodev/semantic-release-gitea": "^2.1.0",
|
||||
"@semantic-release/changelog": "^6.0.3",
|
||||
"@semantic-release/commit-analyzer": "13.0.1",
|
||||
|
||||
Reference in new issue
Block a user