max / audiofiles

Add gitleaks secret-scan step to pre-commit hook Independent guardrail against committing a secret (the SyncKit-key / BUILD_TOKEN class), regardless of whether a value is judged safe. Uses the shared ~/Code/.gitleaks.toml ruleset; skips cleanly if gitleaks is not installed. Task: infra 97ffeda0

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-25 14:48 UTC

Signed with PGP, not checked

Commit: 021c971c20527ef9da6b793801c283683e48c2eb

Parent: 29b1411

1 file changed, +25 insertions, -0 deletions

M scripts/githooks/pre-commit +25

			@@ -15,6 +15,31 @@
15	15		ROOT="$(git rev-parse --show-toplevel)"
16	16		cd "$ROOT"
17	17
	18	+	# --- secret scan (gitleaks) -------------------------------------------------
	19	+	# Independent guardrail: blocks a commit whose staged changes contain a secret,
	20	+	# regardless of whether a human judged the value "safe". Shared ruleset lives at
	21	+	# ~/Code/.gitleaks.toml. Degrades gracefully if gitleaks is not installed (the
	22	+	# astra pre-receive hook is the backstop that always runs). Task: infra 97ffeda0.
	23	+	if command -v gitleaks >/dev/null 2>&1; then
	24	+	GL_CFG=""
	25	+	if [ -f "$ROOT/.gitleaks.toml" ]; then
	26	+	GL_CFG="$ROOT/.gitleaks.toml"
	27	+	elif [ -f "$HOME/Code/.gitleaks.toml" ]; then
	28	+	GL_CFG="$HOME/Code/.gitleaks.toml"
	29	+	fi
	30	+	gl_args=(git --staged --no-banner --redact)
	31	+	[ -n "$GL_CFG" ] && gl_args+=(-c "$GL_CFG")
	32	+	if ! gitleaks "${gl_args[@]}"; then
	33	+	echo "pre-commit: gitleaks found a secret in the staged changes."
	34	+	echo " remove it (or allowlist a false positive), then restage."
	35	+	echo " bypass: git commit --no-verify."
	36	+	exit 1
	37	+	fi
	38	+	echo "pre-commit: gitleaks clean."
	39	+	else
	40	+	echo "pre-commit: gitleaks not installed; skipping secret scan (astra gates on push)."
	41	+	fi
	42	+
18	43		# Paths the gate ignores (extended regex, matched against repo-relative paths).
19	44		# Empty means check everything.
20	45		SKIP_PATHS="${SKIP_PATHS:-}"