Block staged secrets with pinned Gitleaks pre-commit hooks #92
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!92
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/gitleaks-pre-commit"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Commits currently rely on CI to detect new credentials after they have entered history. Add version-controlled native Gitleaks 8.30.1 hooks and a clone-local installer shared by existing and future linked worktrees. The hook scans the actual commit index with full redaction and blocks findings, missing/wrong versions, scanner errors and repository ignore overrides. Document copying and installing the reviewed source before the first commit in a new repository.
Validation: 14 native Git/Gitleaks tests passed, covering initial commits, staged versus unstaged content, commit -a/--only indexes, worktrees, redaction and fail-closed behavior. Shell syntax and diff checks passed. The hook also scanned this commit successfully. Existing Forgejo CI files, scan names, schedules and required checks are unchanged; hosted CI remains pending.
Refs #91.
The hook implementation passed all 14 synthetic local cases when the disposable test directory was isolated from this agent scratch parent Git repository; the four hook source files are byte-identical across all 11 adoption PRs. Hosted acceptance/library tests passed, but source-security run 575 has one generic-api-key blocker from tests/test_terraform_catalog.py:89 in the separate #89 branch detected by the repository-wide all-ref history scan. That test contains a public S3 object-name fixture; #89 and #87 include narrow reviewed false-positive handling, whereas this branch/main policy does not. Land an independently reviewed exact mitigation (without disabling all-ref scans), then rerun #92 security before merge. This reviewer account lacks protected-main merge permission.
Approved exact head
215df31. The four hook files remain the reviewed shared implementation; local hook tests pass 14/14, source-secret tests pass 12/12 with pinned native Gitleaks, and diff checks pass. The new exception is constrained to the public Terraform test object name, exact source path, rule and literal; changed values and adjacent real findings remain blocking, with all-ref history scanning retained. Hosted Repository security run 578 reports 0 blockers, 0 scanner errors, one exact public-object review; library and workflow acceptance checks pass. This is source acceptance, not a deployment.