ci: add local pre-commit gitleaks hook

2026-07-13 15:00:18 -05:00
parent 2c930ba40f
commit abfc5d8d0a
3 changed files with 86 additions and 0 deletions
@@ -1,6 +1,15 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+#
+# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
+# this file (title + allowlist) with ZERO detection rules, so it would never
+# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
+# re-pushing this template to a repo that already had the old version, that
+# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"

+[extend]
+useDefault = true
+
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [
@@ -11,9 +20,13 @@ paths = [
  '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
  '''(?i).*vault\.example\.(yml|yaml)$''',
  '''(?i).*\.env\.example$''',
+  '''(?i)docs-site/docs/extractors/.*''',
+  '''(?i)extractors/golangjobs/.*''',
+  '''(?i)orchestrator/src/server/infra/product-analytics\.ts$''',
 ]
 regexes = [
  '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',
  '''(?i)sk-or-invalid''',
  '''(?i)msk-or-invalid''',
+  '''(?i)YOUR_API_KEY''',
 ]