dc
dbc3044a0f
Review feedback on this PR: with .npmrc setting ignore-scripts=true the prepare script never runs, so the native hooks in .git-hooks/ do not activate on a fresh clone and a commit can go unchecked. Both standard routes are added, the way sasjs/cli and sasjs/lint carry them: - .pre-commit-config.yaml pins the gitleaks hook to v8.30.1, so `pre-commit install` wires the secret scan without the one-time core.hooksPath command. - Build-and-ng-test runs the same pinned @nogoo9/gitleaks binary as a step, because `pre-commit install` is itself a manual command: CI is the enforcement point. --no-git scans the working tree, so the gate is what the pull request adds rather than the repo's history. The scan runs before the job writes client/.npmrc from the NPMRC secret - that file carries the private registry token, so scanning after it would flag the token CI injects itself. .npmrc is unchanged - ignore-scripts=true stays - and the native hooks stay for anyone who prefers them. CONTRIBUTING.md names the framework route next to the existing one-time command. Verified: npm ci followed by the scan reports no leaks on a fresh checkout, the client lint check passes, and pre-commit validate-config plus pre-commit run --all-files both pass.
17 lines
721 B
YAML
17 lines
721 B
YAML
# Hooks for the pre-commit framework - https://pre-commit.com
|
|
#
|
|
# The repo also ships native hooks in .git-hooks/, covering the secret scan, a
|
|
# 2MB commit size limit, a prettier check and Conventional Commits. But .npmrc
|
|
# sets ignore-scripts=true, so the `prepare` script that points git at them
|
|
# never runs on `npm i` - a fresh clone commits unchecked until the one-time
|
|
# command in CONTRIBUTING.md is run by hand.
|
|
#
|
|
# This file is the standard route instead: install the framework once with
|
|
# `pre-commit install`, and the secret scan runs on every commit. The hook is
|
|
# pinned to an exact gitleaks release tag.
|
|
repos:
|
|
- repo: https://github.com/gitleaks/gitleaks
|
|
rev: v8.30.1
|
|
hooks:
|
|
- id: gitleaks
|