chore(hooks): add gitleaks secret scan to pre-commit #317

Open
hermes wants to merge 3 commits from chore/gitleaks-precommit into fix/viya-test-suite-and-refreshcatalog-json
Collaborator

Adds a gitleaks secret scan to the pre-commit hook, before prettier runs, and repairs the pre-existing large-commit check.

What changed

  • .git-hooks/pre-commit: runs gitleaks protect --staged --redact on staged changes before the prettier check. Exits 1 with guidance when a potential secret is found, pointing at .gitleaksignore for false positives.
  • package.json / package-lock.json: adds @nogoo9/gitleaks (8.30.1-post.2) as a root devDependency. It ships the official gitleaks v8.30.1 binaries as platform-scoped optionalDependencies (esbuild-style) - no postinstall scripts, no install-time network calls - so it installs cleanly under the repo's ignore-scripts=true.
  • Hard requirement: the hook uses only the repo-pinned node_modules/.bin/gitleaks - no system-binary fallback, no soft skip. A fresh clone without npm i is blocked with a hint until the binary is installed, so no clone silently skips the secrets scan.
  • .git-hooks/pre-commit (follow-up commit): the pre-existing size check was dead code (both prettier branches exit first) and had three defects of its own - the blocking exit 1 was inside a ( ... ) subshell, the 2**20 arithmetic errors under dash, and it measured HEAD^..HEAD (the previous commit) instead of the content being committed. It now sums the new blob sizes the commit would introduce via git diff --cached --raw, keeps the 2MB threshold and the --no-verify escape hatch, and runs before prettier so it always executes.

Why this wrapper

  • Zero runtime dependencies; the platform binary (verified: linux-x64 is byte-identical to the official v8.30.1 release tarball) is installed by npm's optionalDependencies mechanism only for the matching os/cpu.
  • A gitleaks bin is exposed on node_modules/.bin (as well as npx gitleaks), pinned by package-lock.json.

Verification

  • Full-repo scan (gitleaks dir .) with the default config: no leaks found.
  • Staged-secret test: a realistic AWS key + private key staged in a scratch repo -> leaks found: 2, hook exits 1.
  • Clean staged change -> passes through to the size check then prettier.
  • Missing binary: hook blocks with 'run npm i' and exit 1.
  • Size check: staged 3MB blob -> blocked with exit 1; mode-only change -> 0 new bytes, passes; small change -> passes.
  • npm audit --omit=dev: 0 vulnerabilities (the 5 dev-only advisories are in the pre-existing vendored node_modules/npm package, unrelated to this change).
Adds a gitleaks secret scan to the pre-commit hook, before prettier runs, and repairs the pre-existing large-commit check. ## What changed - **`.git-hooks/pre-commit`**: runs `gitleaks protect --staged --redact` on staged changes before the prettier check. Exits 1 with guidance when a potential secret is found, pointing at `.gitleaksignore` for false positives. - **`package.json` / `package-lock.json`**: adds `@nogoo9/gitleaks` (8.30.1-post.2) as a root devDependency. It ships the official gitleaks v8.30.1 binaries as platform-scoped optionalDependencies (esbuild-style) - **no postinstall scripts, no install-time network calls** - so it installs cleanly under the repo's `ignore-scripts=true`. - **Hard requirement**: the hook uses only the repo-pinned `node_modules/.bin/gitleaks` - no system-binary fallback, no soft skip. A fresh clone without `npm i` is blocked with a hint until the binary is installed, so no clone silently skips the secrets scan. - **`.git-hooks/pre-commit`** (follow-up commit): the pre-existing size check was dead code (both prettier branches exit first) and had three defects of its own - the blocking `exit 1` was inside a `( ... )` subshell, the `2**20` arithmetic errors under dash, and it measured `HEAD^..HEAD` (the previous commit) instead of the content being committed. It now sums the new blob sizes the commit would introduce via `git diff --cached --raw`, keeps the 2MB threshold and the `--no-verify` escape hatch, and runs before prettier so it always executes. ## Why this wrapper - Zero runtime dependencies; the platform binary (verified: linux-x64 is byte-identical to the official v8.30.1 release tarball) is installed by npm's optionalDependencies mechanism only for the matching os/cpu. - A `gitleaks` bin is exposed on `node_modules/.bin` (as well as `npx gitleaks`), pinned by package-lock.json. ## Verification - Full-repo scan (`gitleaks dir .`) with the default config: **no leaks found**. - Staged-secret test: a realistic AWS key + private key staged in a scratch repo -> `leaks found: 2`, hook exits 1. - Clean staged change -> passes through to the size check then prettier. - Missing binary: hook blocks with 'run npm i' and exit 1. - Size check: staged 3MB blob -> blocked with exit 1; mode-only change -> 0 new bytes, passes; small change -> passes. - `npm audit --omit=dev`: 0 vulnerabilities (the 5 dev-only advisories are in the pre-existing vendored `node_modules/npm` package, unrelated to this change).
hermes added 1 commit 2026-09-10 22:37:05 +00:00
chore(hooks): add gitleaks secret scan to pre-commit
Build / Build-and-ng-test (pull_request) Failing after 1m45s
Build / Build-and-test-development (pull_request) Skipped
Lighthouse Checks / lighthouse (pull_request) Successful in 20m14s
b3b9755aa7
Run 'gitleaks protect --staged' before prettier in the pre-commit hook.
The gitleaks binary comes from the @nogoo9/gitleaks devDependency,
which ships official binaries as platform optionalDependencies - no
postinstall scripts, so it installs under ignore-scripts=true.
Falls back to a system gitleaks, and soft-skips with a hint to run
'npm i' on a fresh clone rather than blocking the commit.
hermes added 1 commit 2026-09-10 23:03:52 +00:00
fix(hooks): make the pre-commit size check actually run
Build / Build-and-ng-test (pull_request) Failing after 1m47s
Build / Build-and-test-development (pull_request) Skipped
Lighthouse Checks / lighthouse (pull_request) Successful in 20m51s
53838036e6
The size check sat after the prettier block, whose branches both exit,
so it was unreachable - and it had three further defects: the exit 1
lived inside a ( ... ) subshell so it could never block the commit,
the 2**20 arithmetic errors under /bin/sh (dash) leaving size_limit
unset, and it measured HEAD^..HEAD (the previous commit) rather than
the content being committed, which does not exist yet in pre-commit.

Rewrite it to sum the sizes of the new blobs the commit would
introduce (git diff --cached --raw, new blob ids -> cat-file
--batch-check), keep the 2MB threshold and the documented --no-verify
escape hatch, and move it before the prettier check so it always runs.

Verified with a staged 3MB blob (blocked, exit 1), a small staged
change (passes through to prettier), and a mode-only change (no new
blob, passes).
hermes added 1 commit 2026-09-10 23:06:37 +00:00
fix(hooks): require the repo-pinned gitleaks, drop the fallbacks
Build / Build-and-ng-test (pull_request) Failing after 1m46s
Build / Build-and-test-development (pull_request) Skipped
Lighthouse Checks / lighthouse (pull_request) Successful in 21m12s
fbcde41321
A soft skip (and the system-gitleaks fallback) let a clone without
node_modules commit with no secrets scan at all, so the hook would
never force the install. The hook now hard-blocks with a hint to run
'npm i' until the @nogoo9/gitleaks binary is present in
node_modules/.bin.

Verified with the binary present (scan runs and passes) and absent
(blocked, exit 1).
Some required checks failed
Build / Build-and-ng-test (pull_request) Failing after 1m46s
Build / Build-and-test-development (pull_request) Skipped
Lighthouse Checks / lighthouse (pull_request) Successful in 21m12s
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/gitleaks-precommit:chore/gitleaks-precommit
git checkout chore/gitleaks-precommit
Sign in to join this conversation.