From e264e7952e9835f6d22a7b7d079b253447f5f6a4 Mon Sep 17 00:00:00 2001 From: panish16 Date: Mon, 28 Sep 2026 17:32:05 -0700 Subject: [PATCH] feat: add lefthook pre-commit hook with gitleaks secret scanning Part of the Git Hooks RFC rollout (bcgov/entity#34619). Adds a hooks-only root package.json (no app code at root) that installs lefthook, which runs gitleaks against staged changes on commit. prepare skips lefthook when git is absent and works under both cmd.exe and POSIX sh. lefthook's own postinstall is disabled via allowBuilds in pnpm-workspace.yaml since prepare handles installation. --- .gitleaks.toml | 15 ++++++ lefthook.yml | 9 ++++ package.json | 12 +++++ pnpm-lock.yaml | 114 ++++++++++++++++++++++++++++++++++++++++++++ pnpm-workspace.yaml | 3 ++ 5 files changed, 153 insertions(+) create mode 100644 .gitleaks.toml create mode 100644 lefthook.yml create mode 100644 package.json create mode 100644 pnpm-lock.yaml create mode 100644 pnpm-workspace.yaml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 00000000..2c19fe14 --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,15 @@ +title = "entity gitleaks config" + +# Start from gitleaks' maintained default ruleset and layer an allowlist +# on top for this repo's known false positives, per the Git Hooks RFC: +# https://github.com/bcgov/connect/discussions/23 +[extend] +useDefault = true + +[allowlist] +description = "Files that routinely trip default rules with non-secret content" +paths = [ + '''pnpm-lock\.yaml''', + '''package-lock\.json''', + '''\.gitleaks\.toml''', +] diff --git a/lefthook.yml b/lefthook.yml new file mode 100644 index 00000000..4fc71da5 --- /dev/null +++ b/lefthook.yml @@ -0,0 +1,9 @@ +# Lefthook Git hooks configuration +# https://github.com/evilmartians/lefthook + +pre-commit: + parallel: true + commands: + secret-scan: + tags: security + run: npx gitleaks-secret-scanner diff --git a/package.json b/package.json new file mode 100644 index 00000000..c6b98461 --- /dev/null +++ b/package.json @@ -0,0 +1,12 @@ +{ + "name": "entity-git-hooks", + "private": true, + "type": "module", + "description": "Root-level package for Git hooks tooling only - subfolders manage their own dependencies.", + "scripts": { + "prepare": "git --version && lefthook install || exit 0" + }, + "devDependencies": { + "lefthook": "^1.11.3" + } +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml new file mode 100644 index 00000000..c0428212 --- /dev/null +++ b/pnpm-lock.yaml @@ -0,0 +1,114 @@ +lockfileVersion: '9.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +importers: + + .: + devDependencies: + lefthook: + specifier: ^1.11.3 + version: 1.13.6 + +packages: + + lefthook-darwin-arm64@1.13.6: + resolution: {integrity: sha512-m6Lb77VGc84/Qo21Lhq576pEvcgFCnvloEiP02HbAHcIXD0RTLy9u2yAInrixqZeaz13HYtdDaI7OBYAAdVt8A==} + cpu: [arm64] + os: [darwin] + + lefthook-darwin-x64@1.13.6: + resolution: {integrity: sha512-CoRpdzanu9RK3oXR1vbEJA5LN7iB+c7hP+sONeQJzoOXuq4PNKVtEaN84Gl1BrVtCNLHWFAvCQaZPPiiXSy8qg==} + cpu: [x64] + os: [darwin] + + lefthook-freebsd-arm64@1.13.6: + resolution: {integrity: sha512-X4A7yfvAJ68CoHTqP+XvQzdKbyd935sYy0bQT6Ajz7FL1g7hFiro8dqHSdPdkwei9hs8hXeV7feyTXbYmfjKQQ==} + cpu: [arm64] + os: [freebsd] + + lefthook-freebsd-x64@1.13.6: + resolution: {integrity: sha512-ai2m+Sj2kGdY46USfBrCqLKe9GYhzeq01nuyDYCrdGISePeZ6udOlD1k3lQKJGQCHb0bRz4St0r5nKDSh1x/2A==} + cpu: [x64] + os: [freebsd] + + lefthook-linux-arm64@1.13.6: + resolution: {integrity: sha512-cbo4Wtdq81GTABvikLORJsAWPKAJXE8Q5RXsICFUVznh5PHigS9dFW/4NXywo0+jfFPCT6SYds2zz4tCx6DA0Q==} + cpu: [arm64] + os: [linux] + + lefthook-linux-x64@1.13.6: + resolution: {integrity: sha512-uJl9vjCIIBTBvMZkemxCE+3zrZHlRO7Oc+nZJ+o9Oea3fu+W82jwX7a7clw8jqNfaeBS+8+ZEQgiMHWCloTsGw==} + cpu: [x64] + os: [linux] + + lefthook-openbsd-arm64@1.13.6: + resolution: {integrity: sha512-7r153dxrNRQ9ytRs2PmGKKkYdvZYFPre7My7XToSTiRu5jNCq++++eAKVkoyWPduk97dGIA+YWiEr5Noe0TK2A==} + cpu: [arm64] + os: [openbsd] + + lefthook-openbsd-x64@1.13.6: + resolution: {integrity: sha512-Z+UhLlcg1xrXOidK3aLLpgH7KrwNyWYE3yb7ITYnzJSEV8qXnePtVu8lvMBHs/myzemjBzeIr/U/+ipjclR06g==} + cpu: [x64] + os: [openbsd] + + lefthook-windows-arm64@1.13.6: + resolution: {integrity: sha512-Uxef6qoDxCmUNQwk8eBvddYJKSBFglfwAY9Y9+NnnmiHpWTjjYiObE9gT2mvGVpEgZRJVAatBXc+Ha5oDD/OgQ==} + cpu: [arm64] + os: [win32] + + lefthook-windows-x64@1.13.6: + resolution: {integrity: sha512-mOZoM3FQh3o08M8PQ/b3IYuL5oo36D9ehczIw1dAgp1Ly+Tr4fJ96A+4SEJrQuYeRD4mex9bR7Ps56I73sBSZA==} + cpu: [x64] + os: [win32] + + lefthook@1.13.6: + resolution: {integrity: sha512-ojj4/4IJ29Xn4drd5emqVgilegAPN3Kf0FQM2p/9+lwSTpU+SZ1v4Ig++NF+9MOa99UKY8bElmVrLhnUUNFh5g==} + hasBin: true + +snapshots: + + lefthook-darwin-arm64@1.13.6: + optional: true + + lefthook-darwin-x64@1.13.6: + optional: true + + lefthook-freebsd-arm64@1.13.6: + optional: true + + lefthook-freebsd-x64@1.13.6: + optional: true + + lefthook-linux-arm64@1.13.6: + optional: true + + lefthook-linux-x64@1.13.6: + optional: true + + lefthook-openbsd-arm64@1.13.6: + optional: true + + lefthook-openbsd-x64@1.13.6: + optional: true + + lefthook-windows-arm64@1.13.6: + optional: true + + lefthook-windows-x64@1.13.6: + optional: true + + lefthook@1.13.6: + optionalDependencies: + lefthook-darwin-arm64: 1.13.6 + lefthook-darwin-x64: 1.13.6 + lefthook-freebsd-arm64: 1.13.6 + lefthook-freebsd-x64: 1.13.6 + lefthook-linux-arm64: 1.13.6 + lefthook-linux-x64: 1.13.6 + lefthook-openbsd-arm64: 1.13.6 + lefthook-openbsd-x64: 1.13.6 + lefthook-windows-arm64: 1.13.6 + lefthook-windows-x64: 1.13.6 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 00000000..0a9b7235 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,3 @@ +packages: [] +allowBuilds: + lefthook: false