Chore: [AEA-0000] - use gitleaks for secret scanning#97
Conversation
There was a problem hiding this comment.
Pull request overview
Switches local secret scanning in pre-commit from git-secrets to gitleaks.
Changes:
- Replaced the previous secret-scanning hook with a
gitleakspre-commit hook invocation. - Removed the legacy
.gitallowedallowlist file (previously used forgit-secrets).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.pre-commit-config.yaml |
Removes git-secrets hook and adds a gitleaks hook under the local repo hooks. |
.gitallowed |
Deletes the old allowlist patterns file associated with git-secrets. |
| - -c | ||
| - 'git-secrets --pre_commit_hook' | ||
| - "gitleaks git --pre-commit --redact --staged --verbose" | ||
| language: system |
There was a problem hiding this comment.
This hook doesn’t appear to use the file list that pre-commit will pass by default. To avoid unnecessary arguments (and potential OS argument-length issues on large commits), set pass_filenames: false (and consider always_run: true if you want secret scanning to run even when no files match).
| language: system | |
| language: system | |
| pass_filenames: false | |
| always_run: true |
| description: gitleaks scans commits, commit messages, and --no-ff merges to | ||
| prevent adding secrets into your git repositories. |
There was a problem hiding this comment.
The description claims this hook scans commit messages and --no-ff merges, but default_stages is pre-commit and this command is run in the pre-commit stage. Either adjust the description to match what’s actually being scanned (e.g., staged changes), or add an explicit commit-msg stage hook if commit message scanning is required.
| description: gitleaks scans commits, commit messages, and --no-ff merges to | |
| prevent adding secrets into your git repositories. | |
| description: gitleaks scans staged changes during pre-commit to help | |
| prevent secrets from being added to your git repository. |
use gitleaks for secret scanning