dc
dbc3044a0f
Review feedback on this PR: with .npmrc setting ignore-scripts=true the prepare script never runs, so the native hooks in .git-hooks/ do not activate on a fresh clone and a commit can go unchecked. Both standard routes are added, the way sasjs/cli and sasjs/lint carry them: - .pre-commit-config.yaml pins the gitleaks hook to v8.30.1, so `pre-commit install` wires the secret scan without the one-time core.hooksPath command. - Build-and-ng-test runs the same pinned @nogoo9/gitleaks binary as a step, because `pre-commit install` is itself a manual command: CI is the enforcement point. --no-git scans the working tree, so the gate is what the pull request adds rather than the repo's history. The scan runs before the job writes client/.npmrc from the NPMRC secret - that file carries the private registry token, so scanning after it would flag the token CI injects itself. .npmrc is unchanged - ignore-scripts=true stays - and the native hooks stay for anyone who prefers them. CONTRIBUTING.md names the framework route next to the existing one-time command. Verified: npm ci followed by the scan reports no leaks on a fresh checkout, the client lint check passes, and pre-commit validate-config plus pre-commit run --all-files both pass.