Adds a gitleaks secret scan to the pre-commit hook, before prettier runs, and repairs the pre-existing large-commit check.
What changed
.git-hooks/pre-commit: runs gitleaks protect --staged --redact on staged changes before the prettier check. Exits 1 with guidance when a potential secret is found, pointing at .gitleaksignore for false positives.
package.json / package-lock.json: adds @nogoo9/gitleaks (8.30.1-post.2) as a root devDependency. It ships the official gitleaks v8.30.1 binaries as platform-scoped optionalDependencies (esbuild-style) - no postinstall scripts, no install-time network calls - so it installs cleanly under the repo's ignore-scripts=true.
Hard requirement: the hook uses only the repo-pinned node_modules/.bin/gitleaks - no system-binary fallback, no soft skip. A fresh clone without npm i is blocked with a hint until the binary is installed, so no clone silently skips the secrets scan.
.git-hooks/pre-commit (follow-up commit): the pre-existing size check was dead code (both prettier branches exit first) and had three defects of its own - the blocking exit 1 was inside a ( ... ) subshell, the 2**20 arithmetic errors under dash, and it measured HEAD^..HEAD (the previous commit) instead of the content being committed. It now sums the new blob sizes the commit would introduce via git diff --cached --raw, keeps the 2MB threshold and the --no-verify escape hatch, and runs before prettier so it always executes.
Why this wrapper
Zero runtime dependencies; the platform binary (verified: linux-x64 is byte-identical to the official v8.30.1 release tarball) is installed by npm's optionalDependencies mechanism only for the matching os/cpu.
A gitleaks bin is exposed on node_modules/.bin (as well as npx gitleaks), pinned by package-lock.json.
Verification
Full-repo scan (gitleaks dir .) with the default config: no leaks found.
Staged-secret test: a realistic AWS key + private key staged in a scratch repo -> leaks found: 2, hook exits 1.
Clean staged change -> passes through to the size check then prettier.
Missing binary: hook blocks with 'run npm i' and exit 1.
Size check: staged 3MB blob -> blocked with exit 1; mode-only change -> 0 new bytes, passes; small change -> passes.
npm audit --omit=dev: 0 vulnerabilities (the 5 dev-only advisories are in the pre-existing vendored node_modules/npm package, unrelated to this change).
Adds a gitleaks secret scan to the pre-commit hook, before prettier runs, and repairs the pre-existing large-commit check.
## What changed
- **`.git-hooks/pre-commit`**: runs `gitleaks protect --staged --redact` on staged changes before the prettier check. Exits 1 with guidance when a potential secret is found, pointing at `.gitleaksignore` for false positives.
- **`package.json` / `package-lock.json`**: adds `@nogoo9/gitleaks` (8.30.1-post.2) as a root devDependency. It ships the official gitleaks v8.30.1 binaries as platform-scoped optionalDependencies (esbuild-style) - **no postinstall scripts, no install-time network calls** - so it installs cleanly under the repo's `ignore-scripts=true`.
- **Hard requirement**: the hook uses only the repo-pinned `node_modules/.bin/gitleaks` - no system-binary fallback, no soft skip. A fresh clone without `npm i` is blocked with a hint until the binary is installed, so no clone silently skips the secrets scan.
- **`.git-hooks/pre-commit`** (follow-up commit): the pre-existing size check was dead code (both prettier branches exit first) and had three defects of its own - the blocking `exit 1` was inside a `( ... )` subshell, the `2**20` arithmetic errors under dash, and it measured `HEAD^..HEAD` (the previous commit) instead of the content being committed. It now sums the new blob sizes the commit would introduce via `git diff --cached --raw`, keeps the 2MB threshold and the `--no-verify` escape hatch, and runs before prettier so it always executes.
## Why this wrapper
- Zero runtime dependencies; the platform binary (verified: linux-x64 is byte-identical to the official v8.30.1 release tarball) is installed by npm's optionalDependencies mechanism only for the matching os/cpu.
- A `gitleaks` bin is exposed on `node_modules/.bin` (as well as `npx gitleaks`), pinned by package-lock.json.
## Verification
- Full-repo scan (`gitleaks dir .`) with the default config: **no leaks found**.
- Staged-secret test: a realistic AWS key + private key staged in a scratch repo -> `leaks found: 2`, hook exits 1.
- Clean staged change -> passes through to the size check then prettier.
- Missing binary: hook blocks with 'run npm i' and exit 1.
- Size check: staged 3MB blob -> blocked with exit 1; mode-only change -> 0 new bytes, passes; small change -> passes.
- `npm audit --omit=dev`: 0 vulnerabilities (the 5 dev-only advisories are in the pre-existing vendored `node_modules/npm` package, unrelated to this change).
Run 'gitleaks protect --staged' before prettier in the pre-commit hook.
The gitleaks binary comes from the @nogoo9/gitleaks devDependency,
which ships official binaries as platform optionalDependencies - no
postinstall scripts, so it installs under ignore-scripts=true.
Falls back to a system gitleaks, and soft-skips with a hint to run
'npm i' on a fresh clone rather than blocking the commit.
The size check sat after the prettier block, whose branches both exit,
so it was unreachable - and it had three further defects: the exit 1
lived inside a ( ... ) subshell so it could never block the commit,
the 2**20 arithmetic errors under /bin/sh (dash) leaving size_limit
unset, and it measured HEAD^..HEAD (the previous commit) rather than
the content being committed, which does not exist yet in pre-commit.
Rewrite it to sum the sizes of the new blobs the commit would
introduce (git diff --cached --raw, new blob ids -> cat-file
--batch-check), keep the 2MB threshold and the documented --no-verify
escape hatch, and move it before the prettier check so it always runs.
Verified with a staged 3MB blob (blocked, exit 1), a small staged
change (passes through to prettier), and a mode-only change (no new
blob, passes).
A soft skip (and the system-gitleaks fallback) let a clone without
node_modules commit with no secrets scan at all, so the hook would
never force the install. The hook now hard-blocks with a hint to run
'npm i' until the @nogoo9/gitleaks binary is present in
node_modules/.bin.
Verified with the binary present (scan runs and passes) and absent
(blocked, exit 1).
Some required checks failed
Build / Build-and-ng-test (pull_request) Failing after 1m46s
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds a gitleaks secret scan to the pre-commit hook, before prettier runs, and repairs the pre-existing large-commit check.
What changed
.git-hooks/pre-commit: runsgitleaks protect --staged --redacton staged changes before the prettier check. Exits 1 with guidance when a potential secret is found, pointing at.gitleaksignorefor false positives.package.json/package-lock.json: adds@nogoo9/gitleaks(8.30.1-post.2) as a root devDependency. It ships the official gitleaks v8.30.1 binaries as platform-scoped optionalDependencies (esbuild-style) - no postinstall scripts, no install-time network calls - so it installs cleanly under the repo'signore-scripts=true.node_modules/.bin/gitleaks- no system-binary fallback, no soft skip. A fresh clone withoutnpm iis blocked with a hint until the binary is installed, so no clone silently skips the secrets scan..git-hooks/pre-commit(follow-up commit): the pre-existing size check was dead code (both prettier branches exit first) and had three defects of its own - the blockingexit 1was inside a( ... )subshell, the2**20arithmetic errors under dash, and it measuredHEAD^..HEAD(the previous commit) instead of the content being committed. It now sums the new blob sizes the commit would introduce viagit diff --cached --raw, keeps the 2MB threshold and the--no-verifyescape hatch, and runs before prettier so it always executes.Why this wrapper
gitleaksbin is exposed onnode_modules/.bin(as well asnpx gitleaks), pinned by package-lock.json.Verification
gitleaks dir .) with the default config: no leaks found.leaks found: 2, hook exits 1.npm audit --omit=dev: 0 vulnerabilities (the 5 dev-only advisories are in the pre-existing vendorednode_modules/npmpackage, unrelated to this change).View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.