max / balanced_breakfast

Add gitleaks secret-scan step to pre-commit hook Independent guardrail against committing a secret (the SyncKit-key / BUILD_TOKEN class), regardless of whether a value is judged safe. Uses the shared ~/Code/.gitleaks.toml ruleset; skips cleanly if gitleaks is not installed. Task: infra 97ffeda0

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-25 14:48 UTC

Signed with PGP, not checked

Commit: 5bcddc4bf54a830268eb48b9089ea600c06f86c1

Parent: 600108e

1 file changed, +25 insertions, -0 deletions

M scripts/githooks/pre-commit +25

			@@ -12,6 +12,31 @@
12	12		ROOT="$(git rev-parse --show-toplevel)"
13	13		cd "$ROOT"
14	14
	15	+	# --- secret scan (gitleaks) -------------------------------------------------
	16	+	# Independent guardrail: blocks a commit whose staged changes contain a secret,
	17	+	# regardless of whether a human judged the value "safe". Shared ruleset lives at
	18	+	# ~/Code/.gitleaks.toml. Degrades gracefully if gitleaks is not installed (the
	19	+	# astra pre-receive hook is the backstop that always runs). Task: infra 97ffeda0.
	20	+	if command -v gitleaks >/dev/null 2>&1; then
	21	+	GL_CFG=""
	22	+	if [ -f "$ROOT/.gitleaks.toml" ]; then
	23	+	GL_CFG="$ROOT/.gitleaks.toml"
	24	+	elif [ -f "$HOME/Code/.gitleaks.toml" ]; then
	25	+	GL_CFG="$HOME/Code/.gitleaks.toml"
	26	+	fi
	27	+	gl_args=(git --staged --no-banner --redact)
	28	+	[ -n "$GL_CFG" ] && gl_args+=(-c "$GL_CFG")
	29	+	if ! gitleaks "${gl_args[@]}"; then
	30	+	echo "pre-commit: gitleaks found a secret in the staged changes."
	31	+	echo " remove it (or allowlist a false positive), then restage."
	32	+	echo " bypass: git commit --no-verify."
	33	+	exit 1
	34	+	fi
	35	+	echo "pre-commit: gitleaks clean."
	36	+	else
	37	+	echo "pre-commit: gitleaks not installed; skipping secret scan (astra gates on push)."
	38	+	fi
	39	+
15	40		echo "pre-commit: rustfmt..."
16	41		if ! bash scripts/githooks/rustfmt-gate.sh; then
17	42		echo "pre-commit: rustfmt gate failed, commit aborted (use --no-verify to bypass)."