Install Gitleaks pre-commit hooks across Homelab repositories #91

New issue

Open

opened 2026-10-12 13:09:04 -05:00 by kiyi · 1 comment

kiyi commented

2026-10-12 13:09:04 -05:00

Member

Local installation covers 50 independent clones and 131 existing checkouts; future linked worktrees share the installed hook. Root workspace AGENTS.md now requires setup for new repositories/projects. This is locally installed and tested; repository adoption is awaiting PR review and merge.

Acceptance:

Synthetic staged-secret, redaction, missing/wrong scanner, temporary-index and worktree behavior tests pass (14 cases).
Existing staged work and CI definitions remain unchanged.
Review and merge the hook/template/documentation PRs across the 11 owning repositories.

Follow-up to #1; that closed issue records the existing CI acceptance and remains complete. PR links will be recorded here once published.

Local secret prevention should reject detectable staged credentials before they enter Git history. Add reviewed, version-controlled native Gitleaks 8.30.1 hook sources to all 11 owning repositories, include them in templates, and document installation before the first commit in each clone/project. Existing Forgejo source/history scans, schedules and required status names stay unchanged. Local installation covers 50 independent clones and 131 existing checkouts; future linked worktrees share the installed hook. Root workspace AGENTS.md now requires setup for new repositories/projects. This is locally installed and tested; repository adoption is awaiting PR review and merge. Acceptance: - [x] Synthetic staged-secret, redaction, missing/wrong scanner, temporary-index and worktree behavior tests pass (14 cases). - [x] Existing staged work and CI definitions remain unchanged. - [ ] Review and merge the hook/template/documentation PRs across the 11 owning repositories. Follow-up to #1; that closed issue records the existing CI acceptance and remains complete. PR links will be recorded here once published.

kiyi added this to the Homelab Roadmap project

2026-10-12 13:09:04 -05:00

kiyi referenced this issue

2026-10-12 13:09:53 -05:00

Block staged secrets with pinned Gitleaks pre-commit hooks #92

kiyi referenced this issue from Homelab/Documentation

2026-10-12 13:12:23 -05:00

Block staged secrets with pinned Gitleaks pre-commit hooks #39

kiyi commented

2026-10-12 13:13:32 -05:00

Author

Member

All 11 scoped PRs are published under kiyi, each based on its current main branch:

Validation completed: 14 native Git/Gitleaks hook tests; shell syntax; bundle template source validation; documentation npm run check and npm run build on locked Next.js 16.3.8; all commit hooks and scoped diff checks. Existing Forgejo CI definitions are unchanged. Hooks are installed locally across the inventoried clones/worktrees; repository adoption awaits review/merge. CI was triggered by the PRs and has not been monitored for completion. Root workspace AGENTS.md is updated locally because the grouping directory is not a Git repository.

All 11 scoped PRs are published under kiyi, each based on its current main branch: - [workflows](https://git.gitchegumi.com/Homelab/workflows/pulls/92) - [bundles](https://git.gitchegumi.com/Homelab/bundles/pulls/15) - [actual-budget](https://git.gitchegumi.com/Homelab/actual-budget/pulls/33) - [base-images](https://git.gitchegumi.com/Homelab/base-images/pulls/45) - [Comfy-UI](https://git.gitchegumi.com/Homelab/Comfy-UI/pulls/40) - [Documentation](https://git.gitchegumi.com/Homelab/Documentation/pulls/39) - [GitchAlerts](https://git.gitchegumi.com/Homelab/GitchAlerts/pulls/17) - [platform](https://git.gitchegumi.com/Homelab/platform/pulls/118) - [renovate](https://git.gitchegumi.com/Homelab/renovate/pulls/22) - [terraform-modules](https://git.gitchegumi.com/Homelab/terraform-modules/pulls/5) - [the-gitchistry](https://git.gitchegumi.com/Homelab/the-gitchistry/pulls/4) Validation completed: 14 native Git/Gitleaks hook tests; shell syntax; bundle template source validation; documentation npm run check and npm run build on locked Next.js 16.3.8; all commit hooks and scoped diff checks. Existing Forgejo CI definitions are unchanged. Hooks are installed locally across the inventoried clones/worktrees; repository adoption awaits review/merge. CI was triggered by the PRs and has not been monitored for completion. Root workspace AGENTS.md is updated locally because the grouping directory is not a Git repository.