From df05a8b53254f2ea3be1b9006f7dea9817ad22bc Mon Sep 17 00:00:00 2001
From: panish16 <anish16patel@gmail.com>
Date: Mon, 28 Sep 2026 16:47:20 -0700
Subject: [PATCH] fix: add gitleaks secret scanning to root pre-commit hook

The root lefthook.yml ran `pnpm run lint` and `pnpm run typecheck`, but
the root package.json defines neither script, so any commit touching a
.js/.ts/.vue file failed with ERR_PNPM_NO_SCRIPT, while secrets were
never scanned at all.

Replace with a secret-scan-only hook (npx gitleaks-secret-scanner) and a
.gitleaks.toml extending the default ruleset, matching the pattern live
on bcregistry, ppr and bcregistry-sre. Guard prepare so it skips cleanly
when git is absent and works under cmd.exe on Windows. Move lefthook's
build approval to pnpm-workspace.yaml, since pnpm v11 ignores the
package.json pnpm field.
---
 .gitleaks.toml      | 21 +++++++++++++++++++++
 lefthook.yml        | 11 ++++-------
 package.json        | 15 +--------------
 pnpm-workspace.yaml |  3 +++
 4 files changed, 29 insertions(+), 21 deletions(-)
 create mode 100644 .gitleaks.toml
 create mode 100644 pnpm-workspace.yaml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..6ddebf0
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,21 @@
+title = "connect gitleaks config"
+
+# Start from gitleaks' maintained default ruleset and layer an allowlist
+# on top for known false positives, per the Git Hooks RFC:
+# https://github.com/bcgov/connect/discussions/23
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Lockfiles, this config, and documentation placeholders"
+paths = [
+  '''pnpm-lock\.yaml''',
+  '''package-lock\.json''',
+  '''\.gitleaks\.toml''',
+]
+stopwords = [
+  "YOUR_API_KEY",
+  "YOUR_ACCESS_TOKEN",
+  "<YOUR_API_KEY>",
+  "YOUR_CLIENT_SECRET",
+]
diff --git a/lefthook.yml b/lefthook.yml
index e2c4cb9..4fc71da 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -1,12 +1,9 @@
-# Lefthook Git hooks configuration for Nuxt implementation
+# Lefthook Git hooks configuration
 # https://github.com/evilmartians/lefthook
 
 pre-commit:
   parallel: true
   commands:
-    lint:
-      glob: "*.{js,ts,jsx,tsx,vue}"
-      run: pnpm run lint
-    typecheck:
-      glob: "*.{js,ts,vue}"
-      run: pnpm run typecheck
+    secret-scan:
+      tags: security
+      run: npx gitleaks-secret-scanner
diff --git a/package.json b/package.json
index 0dc8022..260dd9a 100644
--- a/package.json
+++ b/package.json
@@ -3,22 +3,9 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "prepare": "lefthook install"
+    "prepare": "git --version && lefthook install || exit 0"
   },
   "devDependencies": {
     "lefthook": "^1.11.3"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@parcel/watcher",
-      "@sbc-connect/nuxt-auth",
-      "@sbc-connect/nuxt-base",
-      "@sbc-connect/nuxt-forms",
-      "@sbc-connect/nuxt-pay",
-      "better-sqlite3",
-      "esbuild",
-      "sharp",
-      "vue-demi"
-    ]
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..0a9b723
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+packages: []
+allowBuilds:
+  lefthook: false