From 09ae6dc6002855214d8af4ff4883f6aaf9ba2b34 Mon Sep 17 00:00:00 2001 From: panish16 Date: Mon, 28 Sep 2026 19:35:30 -0700 Subject: [PATCH] feat: add lefthook pre-commit hook with gitleaks secret scanning Part of the Git Hooks RFC rollout (bcgov/entity#34619). Adds a hooks-only root package.json (no app code at root) that installs lefthook, which runs gitleaks against staged changes on commit. prepare skips lefthook when git is absent and works under both cmd.exe and POSIX sh. lefthook's own postinstall is disabled via allowBuilds in pnpm-workspace.yaml since prepare handles installation. --- .gitleaks.toml | 16 +++++++ lefthook.yml | 9 ++++ package.json | 12 +++++ pnpm-lock.yaml | 114 ++++++++++++++++++++++++++++++++++++++++++++ pnpm-workspace.yaml | 3 ++ 5 files changed, 154 insertions(+) create mode 100644 .gitleaks.toml create mode 100644 lefthook.yml create mode 100644 package.json create mode 100644 pnpm-lock.yaml create mode 100644 pnpm-workspace.yaml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000000..687bb8501c --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,16 @@ +title = "lear gitleaks config" + +# Start from gitleaks' maintained default ruleset and layer an allowlist +# on top for this repo's known false positives, per the Git Hooks RFC: +# https://github.com/bcgov/connect/discussions/23 +[extend] +useDefault = true + +[allowlist] +description = "Files that routinely trip default rules with non-secret content" +paths = [ + '''pnpm-lock\.yaml''', + '''package-lock\.json''', + '''poetry\.lock''', + '''\.gitleaks\.toml''', +] diff --git a/lefthook.yml b/lefthook.yml new file mode 100644 index 0000000000..4fc71da54c --- /dev/null +++ b/lefthook.yml @@ -0,0 +1,9 @@ +# Lefthook Git hooks configuration +# https://github.com/evilmartians/lefthook + +pre-commit: + parallel: true + commands: + secret-scan: + tags: security + run: npx gitleaks-secret-scanner diff --git a/package.json b/package.json new file mode 100644 index 0000000000..50fb7c8f84 --- /dev/null +++ b/package.json @@ -0,0 +1,12 @@ +{ + "name": "lear-git-hooks", + "private": true, + "type": "module", + "description": "Root-level package for Git hooks tooling only - subfolders manage their own dependencies.", + "scripts": { + "prepare": "git --version && lefthook install || exit 0" + }, + "devDependencies": { + "lefthook": "^1.11.3" + } +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml new file mode 100644 index 0000000000..c0428212eb --- /dev/null +++ b/pnpm-lock.yaml @@ -0,0 +1,114 @@ +lockfileVersion: '9.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +importers: + + .: + devDependencies: + lefthook: + specifier: ^1.11.3 + version: 1.13.6 + +packages: + + lefthook-darwin-arm64@1.13.6: + resolution: {integrity: sha512-m6Lb77VGc84/Qo21Lhq576pEvcgFCnvloEiP02HbAHcIXD0RTLy9u2yAInrixqZeaz13HYtdDaI7OBYAAdVt8A==} + cpu: [arm64] + os: [darwin] + + lefthook-darwin-x64@1.13.6: + resolution: {integrity: sha512-CoRpdzanu9RK3oXR1vbEJA5LN7iB+c7hP+sONeQJzoOXuq4PNKVtEaN84Gl1BrVtCNLHWFAvCQaZPPiiXSy8qg==} + cpu: [x64] + os: [darwin] + + lefthook-freebsd-arm64@1.13.6: + resolution: {integrity: sha512-X4A7yfvAJ68CoHTqP+XvQzdKbyd935sYy0bQT6Ajz7FL1g7hFiro8dqHSdPdkwei9hs8hXeV7feyTXbYmfjKQQ==} + cpu: [arm64] + os: [freebsd] + + lefthook-freebsd-x64@1.13.6: + resolution: {integrity: sha512-ai2m+Sj2kGdY46USfBrCqLKe9GYhzeq01nuyDYCrdGISePeZ6udOlD1k3lQKJGQCHb0bRz4St0r5nKDSh1x/2A==} + cpu: [x64] + os: [freebsd] + + lefthook-linux-arm64@1.13.6: + resolution: {integrity: sha512-cbo4Wtdq81GTABvikLORJsAWPKAJXE8Q5RXsICFUVznh5PHigS9dFW/4NXywo0+jfFPCT6SYds2zz4tCx6DA0Q==} + cpu: [arm64] + os: [linux] + + lefthook-linux-x64@1.13.6: + resolution: {integrity: sha512-uJl9vjCIIBTBvMZkemxCE+3zrZHlRO7Oc+nZJ+o9Oea3fu+W82jwX7a7clw8jqNfaeBS+8+ZEQgiMHWCloTsGw==} + cpu: [x64] + os: [linux] + + lefthook-openbsd-arm64@1.13.6: + resolution: {integrity: sha512-7r153dxrNRQ9ytRs2PmGKKkYdvZYFPre7My7XToSTiRu5jNCq++++eAKVkoyWPduk97dGIA+YWiEr5Noe0TK2A==} + cpu: [arm64] + os: [openbsd] + + lefthook-openbsd-x64@1.13.6: + resolution: {integrity: sha512-Z+UhLlcg1xrXOidK3aLLpgH7KrwNyWYE3yb7ITYnzJSEV8qXnePtVu8lvMBHs/myzemjBzeIr/U/+ipjclR06g==} + cpu: [x64] + os: [openbsd] + + lefthook-windows-arm64@1.13.6: + resolution: {integrity: sha512-Uxef6qoDxCmUNQwk8eBvddYJKSBFglfwAY9Y9+NnnmiHpWTjjYiObE9gT2mvGVpEgZRJVAatBXc+Ha5oDD/OgQ==} + cpu: [arm64] + os: [win32] + + lefthook-windows-x64@1.13.6: + resolution: {integrity: sha512-mOZoM3FQh3o08M8PQ/b3IYuL5oo36D9ehczIw1dAgp1Ly+Tr4fJ96A+4SEJrQuYeRD4mex9bR7Ps56I73sBSZA==} + cpu: [x64] + os: [win32] + + lefthook@1.13.6: + resolution: {integrity: sha512-ojj4/4IJ29Xn4drd5emqVgilegAPN3Kf0FQM2p/9+lwSTpU+SZ1v4Ig++NF+9MOa99UKY8bElmVrLhnUUNFh5g==} + hasBin: true + +snapshots: + + lefthook-darwin-arm64@1.13.6: + optional: true + + lefthook-darwin-x64@1.13.6: + optional: true + + lefthook-freebsd-arm64@1.13.6: + optional: true + + lefthook-freebsd-x64@1.13.6: + optional: true + + lefthook-linux-arm64@1.13.6: + optional: true + + lefthook-linux-x64@1.13.6: + optional: true + + lefthook-openbsd-arm64@1.13.6: + optional: true + + lefthook-openbsd-x64@1.13.6: + optional: true + + lefthook-windows-arm64@1.13.6: + optional: true + + lefthook-windows-x64@1.13.6: + optional: true + + lefthook@1.13.6: + optionalDependencies: + lefthook-darwin-arm64: 1.13.6 + lefthook-darwin-x64: 1.13.6 + lefthook-freebsd-arm64: 1.13.6 + lefthook-freebsd-x64: 1.13.6 + lefthook-linux-arm64: 1.13.6 + lefthook-linux-x64: 1.13.6 + lefthook-openbsd-arm64: 1.13.6 + lefthook-openbsd-x64: 1.13.6 + lefthook-windows-arm64: 1.13.6 + lefthook-windows-x64: 1.13.6 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 0000000000..0a9b723558 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,3 @@ +packages: [] +allowBuilds: + lefthook: false