[jmjava]

Summary

• Add the official ggshield pre-commit hook (id: ggshield, rev v1.56.1) so secret scan pre-commit runs from .pre-commit-config.yaml.
• Keep the existing check-added-large-files and local ruff hooks.
• Credentials stay outside the repo. No API key, token, or .env is committed.

Test plan

• python3 -m pre_commit validate-config .pre-commit-config.yaml (MemAvailable above 8 GiB)
• Confirm a later commit with pre-commit installed runs the ggshield hook and that a missing GitGuardian login fails closed without a key in the tree

Made with Cursor