chore(security): add gitleaks pre-commit + CI secret scan (LAC-2555) - #34
chore(security): add gitleaks pre-commit + CI secret scan (LAC-2555)#34lacymorrow wants to merge 2 commits into
Conversation
Defense-in-depth to prevent plaintext credentials from reaching the repo. - `.github/workflows/gitleaks.yml` — Gitleaks Action on every PR/main push. - `.gitleaks.toml` — extends default rules; allowlists example env files, docs, and generated LLM crawl fixtures. - `.githooks/pre-commit` — local scan of staged changes when gitleaks is installed; graceful skip + warning otherwise (CI still runs). - `package.json` postinstall wires `core.hooksPath` to `.githooks/` on every install so the hook auto-activates without a new devDependency. If a real secret is caught: rotate first, then remove from the diff (knowledge/agent-common.md → Secret handling).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Failed to generate code suggestions for PR |
gitleaks-action@v2 requires a paid license on GitHub Organizations (shipkit-io hit "missing gitleaks license" and failed every run). Install the CLI directly and scan the PR/push diff — same coverage, no license needed, matches the pattern merged in lacymorrow/shipkit#277.
|
Pushed 8c7a078 — replaced Root cause of the 6-week check failure: Verified: new gitleaks run on this PR passes in 7s (https://github.com/shipkit-io/bones/actions/runs/32883093758). Remaining non-blocking noise on this PR (unrelated to the secret-scanner add):
The PR content itself (gitleaks CI + config + hook + unrelated repo tidy) is unchanged from the 2026-07-06 commit; only the workflow install method changed. Ready for merge review — flagged on LAC-3287. |
1 participant
Summary
Adds a two-layer secret scanner per LAC-2555 (Paperclip): CI-side gate + local pre-commit hook. Follows LAC-2548, where a plaintext OpenAI key made it into the repo.
.github/workflows/gitleaks.ymlruns gitleaks-action on every PR and every push tomain. Fails the check if a plaintext credential appears in the diff..githooks/pre-commitrunsgitleaks protect --stagedwhen the binary is installed. Graceful skip + warning if not — CI still catches it either way.postinstallsetsgit config core.hooksPath .githooksso the hook activates on the next install without adding a new devDependency..gitleaks.tomlextends the default rule set and allowlists placeholder-credential files (.env.example*,docs/, LLM crawl fixtures) so we don't false-positive.Scope kept tight per Rule 28 — no refactors, no other changes.
Test plan
git config core.hooksPathreads.githooksafterpnpm install/bun install.echo "AWS_SECRET_ACCESS_KEY=AKIA...redacted" > /tmp/leak.txt && git add /tmp/leak.txt && git commit -m testshould fail locally (if gitleaks installed) or on CI.Refs: LAC-2555, LAC-2548, LAC-2554 (credential rotation, tracked separately).