From ff8dee7f625448bf06f9c320d865a9337b7495e7 Mon Sep 17 00:00:00 2001 From: panish16 Date: Thu, 1 Oct 2026 16:10:54 -0700 Subject: [PATCH] feat: add lefthook pre-commit hook with gitleaks secret scanning Part of the Git Hooks RFC rollout (bcgov/entity#34619). Adds a hooks-only root package.json (no app code at root) that installs lefthook, which runs gitleaks against staged changes on commit. prepare skips lefthook when git is absent and works under both cmd.exe and POSIX sh. lefthook's own postinstall is disabled via allowBuilds in pnpm-workspace.yaml since prepare handles installation. --- .gitleaks.toml | 16 +++++++ lefthook.yml | 9 ++++ package.json | 12 +++++ pnpm-lock.yaml | 114 ++++++++++++++++++++++++++++++++++++++++++++ pnpm-workspace.yaml | 3 ++ 5 files changed, 154 insertions(+) create mode 100644 .gitleaks.toml create mode 100644 lefthook.yml create mode 100644 package.json create mode 100644 pnpm-lock.yaml create mode 100644 pnpm-workspace.yaml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 000000000..bdc0af9a9 --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,16 @@ +title = "namerequest gitleaks config" + +# Start from gitleaks' maintained default ruleset and layer an allowlist +# on top for this repo's known false positives, per the Git Hooks RFC: +# https://github.com/bcgov/connect/discussions/23 +[extend] +useDefault = true + +[allowlist] +description = "Files that routinely trip default rules with non-secret content" +paths = [ + '''pnpm-lock\.yaml''', + '''package-lock\.json''', + '''poetry\.lock''', + '''\.gitleaks\.toml''', +] diff --git a/lefthook.yml b/lefthook.yml new file mode 100644 index 000000000..4fc71da54 --- /dev/null +++ b/lefthook.yml @@ -0,0 +1,9 @@ +# Lefthook Git hooks configuration +# https://github.com/evilmartians/lefthook + +pre-commit: + parallel: true + commands: + secret-scan: + tags: security + run: npx gitleaks-secret-scanner diff --git a/package.json b/package.json new file mode 100644 index 000000000..5821e1de3 --- /dev/null +++ b/package.json @@ -0,0 +1,12 @@ +{ + "name": "namerequest-git-hooks", + "private": true, + "type": "module", + "description": "Root-level package for Git hooks tooling only - subfolders manage their own dependencies.", + "scripts": { + "prepare": "git --version && lefthook install || exit 0" + }, + "devDependencies": { + "lefthook": "^1.11.3" + } +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml new file mode 100644 index 000000000..c0428212e --- /dev/null +++ b/pnpm-lock.yaml @@ -0,0 +1,114 @@ +lockfileVersion: '9.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +importers: + + .: + devDependencies: + lefthook: + specifier: ^1.11.3 + version: 1.13.6 + +packages: + + lefthook-darwin-arm64@1.13.6: + resolution: {integrity: sha512-m6Lb77VGc84/Qo21Lhq576pEvcgFCnvloEiP02HbAHcIXD0RTLy9u2yAInrixqZeaz13HYtdDaI7OBYAAdVt8A==} + cpu: [arm64] + os: [darwin] + + lefthook-darwin-x64@1.13.6: + resolution: {integrity: sha512-CoRpdzanu9RK3oXR1vbEJA5LN7iB+c7hP+sONeQJzoOXuq4PNKVtEaN84Gl1BrVtCNLHWFAvCQaZPPiiXSy8qg==} + cpu: [x64] + os: [darwin] + + lefthook-freebsd-arm64@1.13.6: + resolution: {integrity: sha512-X4A7yfvAJ68CoHTqP+XvQzdKbyd935sYy0bQT6Ajz7FL1g7hFiro8dqHSdPdkwei9hs8hXeV7feyTXbYmfjKQQ==} + cpu: [arm64] + os: [freebsd] + + lefthook-freebsd-x64@1.13.6: + resolution: {integrity: sha512-ai2m+Sj2kGdY46USfBrCqLKe9GYhzeq01nuyDYCrdGISePeZ6udOlD1k3lQKJGQCHb0bRz4St0r5nKDSh1x/2A==} + cpu: [x64] + os: [freebsd] + + lefthook-linux-arm64@1.13.6: + resolution: {integrity: sha512-cbo4Wtdq81GTABvikLORJsAWPKAJXE8Q5RXsICFUVznh5PHigS9dFW/4NXywo0+jfFPCT6SYds2zz4tCx6DA0Q==} + cpu: [arm64] + os: [linux] + + lefthook-linux-x64@1.13.6: + resolution: {integrity: sha512-uJl9vjCIIBTBvMZkemxCE+3zrZHlRO7Oc+nZJ+o9Oea3fu+W82jwX7a7clw8jqNfaeBS+8+ZEQgiMHWCloTsGw==} + cpu: [x64] + os: [linux] + + lefthook-openbsd-arm64@1.13.6: + resolution: {integrity: sha512-7r153dxrNRQ9ytRs2PmGKKkYdvZYFPre7My7XToSTiRu5jNCq++++eAKVkoyWPduk97dGIA+YWiEr5Noe0TK2A==} + cpu: [arm64] + os: [openbsd] + + lefthook-openbsd-x64@1.13.6: + resolution: {integrity: sha512-Z+UhLlcg1xrXOidK3aLLpgH7KrwNyWYE3yb7ITYnzJSEV8qXnePtVu8lvMBHs/myzemjBzeIr/U/+ipjclR06g==} + cpu: [x64] + os: [openbsd] + + lefthook-windows-arm64@1.13.6: + resolution: {integrity: sha512-Uxef6qoDxCmUNQwk8eBvddYJKSBFglfwAY9Y9+NnnmiHpWTjjYiObE9gT2mvGVpEgZRJVAatBXc+Ha5oDD/OgQ==} + cpu: [arm64] + os: [win32] + + lefthook-windows-x64@1.13.6: + resolution: {integrity: sha512-mOZoM3FQh3o08M8PQ/b3IYuL5oo36D9ehczIw1dAgp1Ly+Tr4fJ96A+4SEJrQuYeRD4mex9bR7Ps56I73sBSZA==} + cpu: [x64] + os: [win32] + + lefthook@1.13.6: + resolution: {integrity: sha512-ojj4/4IJ29Xn4drd5emqVgilegAPN3Kf0FQM2p/9+lwSTpU+SZ1v4Ig++NF+9MOa99UKY8bElmVrLhnUUNFh5g==} + hasBin: true + +snapshots: + + lefthook-darwin-arm64@1.13.6: + optional: true + + lefthook-darwin-x64@1.13.6: + optional: true + + lefthook-freebsd-arm64@1.13.6: + optional: true + + lefthook-freebsd-x64@1.13.6: + optional: true + + lefthook-linux-arm64@1.13.6: + optional: true + + lefthook-linux-x64@1.13.6: + optional: true + + lefthook-openbsd-arm64@1.13.6: + optional: true + + lefthook-openbsd-x64@1.13.6: + optional: true + + lefthook-windows-arm64@1.13.6: + optional: true + + lefthook-windows-x64@1.13.6: + optional: true + + lefthook@1.13.6: + optionalDependencies: + lefthook-darwin-arm64: 1.13.6 + lefthook-darwin-x64: 1.13.6 + lefthook-freebsd-arm64: 1.13.6 + lefthook-freebsd-x64: 1.13.6 + lefthook-linux-arm64: 1.13.6 + lefthook-linux-x64: 1.13.6 + lefthook-openbsd-arm64: 1.13.6 + lefthook-openbsd-x64: 1.13.6 + lefthook-windows-arm64: 1.13.6 + lefthook-windows-x64: 1.13.6 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 000000000..0a9b72355 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,3 @@ +packages: [] +allowBuilds: + lefthook: false