Block staged secrets with pinned Gitleaks pre-commit hooks #39

Merged

portegumi merged 1 commit from kiyi/gitleaks-pre-commit into main

2026-10-12 14:30:30 -05:00

kiyi commented

2026-10-12 13:12:23 -05:00

Member

Validation: the identical hook passed 14 native Git/Gitleaks behavioral tests in Homelab/workflows, shell syntax checks and local worktree coverage checks. This commit passed the installed hook, and the scoped diff passes whitespace checks. Existing CI source/history scans, schedules, workflow/job names and required checks are unchanged. Hosted CI is pending.

Refs Homelab/workflows#91; canonical implementation and tests: Homelab/workflows#92.

Record the dated local installation/validation and pending repository rollout in delivery-and-operations, with a verified commit permalink to the proposed canonical runbook. npm ci from the lockfile, npm run check, and npm run build passed on the PR worktree (Next.js 16.3.8).

Add the reviewed native Gitleaks 8.30.1 pre-commit hook and setup instructions so detectable staged credentials are blocked before entering Git history. Installation uses clone-local shared Git metadata to cover existing and future linked worktrees, preserves other hooks, and blocks findings or scanner errors with full redaction. New clones must run the installer before their first commit. Validation: the identical hook passed 14 native Git/Gitleaks behavioral tests in Homelab/workflows, shell syntax checks and local worktree coverage checks. This commit passed the installed hook, and the scoped diff passes whitespace checks. Existing CI source/history scans, schedules, workflow/job names and required checks are unchanged. Hosted CI is pending. Refs Homelab/workflows#91; canonical implementation and tests: Homelab/workflows#92. Record the dated local installation/validation and pending repository rollout in delivery-and-operations, with a verified commit permalink to the proposed canonical runbook. npm ci from the lockfile, npm run check, and npm run build passed on the PR worktree (Next.js 16.3.8).

kiyi added 1 commit

2026-10-12 13:12:24 -05:00

Block staged secrets with pinned Gitleaks pre-commit hooks

Source security / security (pull_request) Successful in 2m20s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate (pull_request) Successful in 2m40s

Details

163cb5978e

kiyi referenced this pull request from Homelab/workflows

2026-10-12 13:13:32 -05:00

Install Gitleaks pre-commit hooks across Homelab repositories #91

portegumi approved these changes

2026-10-12 14:30:28 -05:00

portegumi left a comment

Reviewed the 11-repository hook rollout: all four hook files are byte-identical across PR heads; the central workflow suite passes all 14 synthetic tests with the isolated Git ceiling required by this agent scratch directory. This repository changes only the reviewed hook/install/docs surface, and its exact-head checks are green. Hooks supplement, not replace, source/history CI scans; no deployment.

portegumi merged commit f84f716eac into main

2026-10-12 14:30:30 -05:00

portegumi deleted branch kiyi/gitleaks-pre-commit

2026-10-12 14:30:31 -05:00

portegumi referenced this pull request from a commit

2026-10-12 14:30:32 -05:00

Block staged secrets with pinned Gitleaks pre-commit hooks (#39)