ci: Add Gitleaks pre-commit hook for detecting potential credentials #1153
+5
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instructions to reviewer on how to test:
Pull this branch and verify that
pre-commit
hooks are active.Run the following command to confirm
gitleaks
is correctly set up:This should include output from gitleaks, detecting potential hardcoded secrets.
Note: It is assumed that the CI environment handles installing gitleaks as part of the
pre-commit
configuration.For local testing, the following setup was used:
Test gitleaks manually by attempting to commit a file containing a fake secret (e.g., a fake API key or private key).
The commit should be blocked by gitleaks if the secret is detected. Note that detection may include false positives or occasionally miss some secrets (false negatives).
For more information, including configuration options for customizing detection rules, refer to the official documentation:
https://github.com/gitleaks/gitleaks