Chore: [AEA-0000] - use gitleaks for secret scanning#143
Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to migrate local secret-scanning to gitleaks by updating the repository’s pre-commit hooks, as part of the repo’s developer tooling and security checks.
Changes:
- Replaces the local pre-commit
git-secretshook with agitleakshook. - Removes the
.gitallowedallowlist file previously used withgit-secrets. - Applies minor YAML formatting changes to some hook
args/types_orlists.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.pre-commit-config.yaml |
Updates local pre-commit configuration to run gitleaks instead of git-secrets for secret scanning. |
.gitallowed |
Removes the git-secrets allowlist file from the repo. |
| description: gitleaks scans commits, commit messages, and --no-ff merges to | ||
| prevent adding secrets into your git repositories. | ||
| entry: bash | ||
| args: | ||
| - -c | ||
| - "git-secrets --pre_commit_hook" | ||
| - "gitleaks git --pre-commit --redact --staged --verbose" |
There was a problem hiding this comment.
The gitleaks hook description looks like it was copied from the previous git-secrets hook (mentions scanning commit messages and --no-ff merges). With the current command (gitleaks ... --staged), it’s describing different behavior, which can confuse contributors. Please update the description to match what this hook actually scans and how it’s intended to be used in this repo.
| - id: gitleaks | ||
| name: Git Leaks | ||
| description: gitleaks scans commits, commit messages, and --no-ff merges to | ||
| prevent adding secrets into your git repositories. | ||
| entry: bash | ||
| args: | ||
| - -c | ||
| - "git-secrets --pre_commit_hook" | ||
| - "gitleaks git --pre-commit --redact --staged --verbose" | ||
| language: system |
There was a problem hiding this comment.
This PR switches the local pre-commit secret scan from git-secrets to gitleaks, and also removes the repo’s .gitallowed allowlist. However, the repository still appears to run git-secrets-based scanning in CI (e.g. quality-checks-devcontainer.yml runs git-secrets / make secret-scan). That mismatch makes the change incomplete and could cause CI failures or different secret-scanning results between local and CI (especially now that .gitallowed is gone). Please align CI and local secret scanning to the same tool (migrate CI to gitleaks too, or keep git-secrets/allowlist until CI is updated).
|
use gitleaks for secret scanning