mathias
d98a305985
task check -> security:gitleaks was already CI-enforced here, but that
catches a leak after the push, not before -- exactly the gap infra#39's
prevention checklist called out ("gitleaks pre-commit hook in both infra
and hyperguild"), true for infra but not this repo.
Mirrors infra's own .githooks/pre-commit, minus the YAML/image-tag
checks that are infra-manifest-specific and don't apply here.
Verified functionally, not just wired: staged a real high-entropy fake
key and confirmed `git commit` is blocked by the hook
(RuleID=generic-api-key); staged a well-known documented-example AWS
key (AKIAIOSFODNN7EXAMPLE) first and confirmed gitleaks correctly
passes it (it's not a real leak, and gitleaks' own default rules know
that) -- worth recording since a naive fixture check would have looked
like detection was broken.
Enable per clone: git config core.hooksPath .githooks
35 lines
1.4 KiB
Bash
Executable File
35 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pre-commit secret scan for the hyperguild repo.
|
|
#
|
|
# task check -> security:gitleaks enforces this in CI, but CI is after the
|
|
# push. This catches a staged secret before it ever leaves the machine --
|
|
# the infra#39 rotation pass found exactly this class of leak (a printed
|
|
# credential, committed, archived into git) and there was no local gate to
|
|
# have caught it. Mirrors infra's own .githooks/pre-commit (infra#326).
|
|
#
|
|
# Enable once per clone: git config core.hooksPath .githooks
|
|
# Bypass if absolutely needed: git commit --no-verify
|
|
|
|
set -euo pipefail
|
|
|
|
GITLEAKS="$(command -v gitleaks || true)"
|
|
if [[ -z "$GITLEAKS" && -x "$(go env GOPATH 2>/dev/null)/bin/gitleaks" ]]; then
|
|
GITLEAKS="$(go env GOPATH)/bin/gitleaks"
|
|
fi
|
|
|
|
if [[ -z "$GITLEAKS" ]]; then
|
|
echo "⚠ gitleaks not installed — skipping local secret scan (CI still enforces it)."
|
|
echo " Install: go install github.com/zricethezav/gitleaks/v8@latest"
|
|
exit 0
|
|
fi
|
|
|
|
echo "→ Scanning staged changes for secrets..."
|
|
if ! "$GITLEAKS" protect --staged --redact --config .gitleaks.toml >/dev/null 2>&1; then
|
|
echo " ✗ gitleaks found a secret in the staged changes."
|
|
echo " Review with: gitleaks protect --staged --redact --config .gitleaks.toml -v"
|
|
echo " If it is a false positive, allowlist it in .gitleaks.toml or add a"
|
|
echo " '# gitleaks:allow' comment. Do NOT --no-verify a real secret."
|
|
exit 1
|
|
fi
|
|
echo " ✓ no staged secrets"
|