Chore: [AEA-0000] - use gitleaks for secret scanning#657
Conversation
There was a problem hiding this comment.
Pull request overview
This PR replaces the existing pre-commit secret scanning approach with a gitleaks-based hook, aiming to prevent committing secrets into the repository.
Changes:
- Swap the pre-commit secret scanning hook from
git-secretstogitleaks. - Remove the
.gitallowedallowlist file that was associated with the previous approach.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.pre-commit-config.yaml |
Replaces the secret-scanning pre-commit hook to run gitleaks. |
.gitallowed |
Removes the legacy allowlist file used by the previous secret scanning setup. |
| description: gitleaks scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories. | ||
| entry: bash | ||
| args: | ||
| - -c | ||
| - 'git-secrets --pre_commit_hook' | ||
| - "gitleaks git --pre-commit --redact --staged --verbose" |
There was a problem hiding this comment.
The hook description says it scans commits, commit messages, and --no-ff merges, but the configured command (gitleaks git --pre-commit --staged) will only scan staged changes and won’t cover commit messages (and default_stages is pre-commit only). Please either update the description to match the actual behavior, or add the appropriate stage(s)/commands to scan commit messages as intended.
| entry: bash | ||
| args: | ||
| - -c | ||
| - 'git-secrets --pre_commit_hook' | ||
| - "gitleaks git --pre-commit --redact --staged --verbose" | ||
| language: system |
There was a problem hiding this comment.
This hook uses language: system and invokes gitleaks directly, but the repo’s make install target and docs don’t install/mention gitleaks. This will cause pre-commit to fail for contributors without a preinstalled gitleaks binary. Consider switching to the official pre-commit-managed gitleaks hook (pinned rev), or ensure gitleaks is installed as part of the project setup (and set pass_filenames: false / always_run: true like the other local hooks since filenames aren’t used).
|
use gitleaks for secret scanning