Follow-ups from the review of #414.
The credential guard now checks each staged .npmrc rather than only the client
one: the root and sas/ files are tracked policy as well, so a token pasted into
either was equally one `git add -A` away. Verified by staging a token in
sas/.npmrc - the hook exits 1.
$RUNNER_TEMP/npmrc is removed at the end of each job that writes it, with
`if: always()` so a failed job cleans up too.
The root `install` script is gone: the root .npmrc sets ignore-scripts, so npm
never ran it. CONTRIBUTING already spells out the per-project commands, and is
now the single source.
The release workflows build the published client from the same tree, so they run
`check:archiver` like build.yaml does.
client/.npmrc is tracked now, so a token left in it from the old pattern is one
`git add -A` from being committed. Prose in CONTRIBUTING is not a control: the
pre-commit hook fails when the staged file holds _authToken, _auth or _password.
`npm run check:archiver` runs the directory-walk guard, so it is reproducible
before a push instead of only in CI, and the CI step calls the same script.
CONTRIBUTING now spells out the per-project installs, since the root .npmrc has
ignore-scripts=true and the composite install script therefore never runs.
A soft skip (and the system-gitleaks fallback) let a clone without
node_modules commit with no secrets scan at all, so the hook would
never force the install. The hook now hard-blocks with a hint to run
'npm i' until the @nogoo9/gitleaks binary is present in
node_modules/.bin.
Verified with the binary present (scan runs and passes) and absent
(blocked, exit 1).
The size check sat after the prettier block, whose branches both exit,
so it was unreachable - and it had three further defects: the exit 1
lived inside a ( ... ) subshell so it could never block the commit,
the 2**20 arithmetic errors under /bin/sh (dash) leaving size_limit
unset, and it measured HEAD^..HEAD (the previous commit) rather than
the content being committed, which does not exist yet in pre-commit.
Rewrite it to sum the sizes of the new blobs the commit would
introduce (git diff --cached --raw, new blob ids -> cat-file
--batch-check), keep the 2MB threshold and the documented --no-verify
escape hatch, and move it before the prettier check so it always runs.
Verified with a staged 3MB blob (blocked, exit 1), a small staged
change (passes through to prettier), and a mode-only change (no new
blob, passes).
Run 'gitleaks protect --staged' before prettier in the pre-commit hook.
The gitleaks binary comes from the @nogoo9/gitleaks devDependency,
which ships official binaries as platform optionalDependencies - no
postinstall scripts, so it installs under ignore-scripts=true.
Falls back to a system gitleaks, and soft-skips with a hint to run
'npm i' on a fresh clone rather than blocking the commit.
dc
allan