Skip to content

fix: add gitleaks secret scanning to root pre-commit hook - #126

Closed
panish16 wants to merge 1 commit into
bcgov:mainfrom
panish16:fix/root-hook-secret-scan
Closed

panish16 wants to merge 1 commit into
bcgov:mainfrom
panish16:fix/root-hook-secret-scan

Conversation

@panish16

@panish16 panish16 commented Sep 28, 2026 •

Copy link
Copy Markdown

NA

The root lefthook.yml ran `pnpm run lint` and `pnpm run typecheck`, but
the root package.json defines neither script, so any commit touching a
.js/.ts/.vue file failed with ERR_PNPM_NO_SCRIPT, while secrets were
never scanned at all.

Replace with a secret-scan-only hook (npx gitleaks-secret-scanner) and a
.gitleaks.toml extending the default ruleset, matching the pattern live
on bcregistry, ppr and bcregistry-sre. Guard prepare so it skips cleanly
when git is absent and works under cmd.exe on Windows. Move lefthook's
build approval to pnpm-workspace.yaml, since pnpm v11 ignores the
package.json pnpm field.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants