fix: add gitleaks secret scanning to root pre-commit hook

.gitleaks.toml

@@ -0,0 +1,21 @@
+title = "connect gitleaks config"
+
+# Start from gitleaks' maintained default ruleset and layer an allowlist
+# on top for known false positives, per the Git Hooks RFC:
+# https://github.com/bcgov/connect/discussions/23
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Lockfiles, this config, and documentation placeholders"
+paths = [
+  '''pnpm-lock\.yaml''',
+  '''package-lock\.json''',
+  '''\.gitleaks\.toml''',
+]
+stopwords = [
+  "YOUR_API_KEY",
+  "YOUR_ACCESS_TOKEN",
+  "<YOUR_API_KEY>",
+  "YOUR_CLIENT_SECRET",
+]

lefthook.yml

@@ -1,12 +1,9 @@
-# Lefthook Git hooks configuration for Nuxt implementation
+# Lefthook Git hooks configuration
 # https://github.com/evilmartians/lefthook
 
 pre-commit:
   parallel: true
   commands:
-    lint:
-      glob: "*.{js,ts,jsx,tsx,vue}"
-      run: pnpm run lint
-    typecheck:
-      glob: "*.{js,ts,vue}"
-      run: pnpm run typecheck
+    secret-scan:
+      tags: security
+      run: npx gitleaks-secret-scanner

package.json

@@ -3,22 +3,9 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "prepare": "lefthook install"
+    "prepare": "git --version && lefthook install || exit 0"
   },
   "devDependencies": {
     "lefthook": "^1.11.3"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@parcel/watcher",
-      "@sbc-connect/nuxt-auth",
-      "@sbc-connect/nuxt-base",
-      "@sbc-connect/nuxt-forms",
-      "@sbc-connect/nuxt-pay",
-      "better-sqlite3",
-      "esbuild",
-      "sharp",
-      "vue-demi"
-    ]
   }
 }

pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages: []
+allowBuilds:
+  lefthook: false