Mannu
1e423956be
'gitleaks protect' is the deprecated alias. Both work today, but the deprecated form will eventually be removed and the failure mode is a silently non-functioning secret gate — worse than no gate, because it is trusted. Verified end-to-end: staging a file containing a Supabase service-role JWT and a GitHub PAT causes the pre-commit hook to exit 1 and block the commit. Refs C-03
16 lines
500 B
YAML
16 lines
500 B
YAML
# Pre-commit gate. Installed with: lefthook install
|
|
pre-commit:
|
|
parallel: true
|
|
commands:
|
|
gitleaks:
|
|
run: gitleaks git --staged --no-banner --redact
|
|
no-large-files:
|
|
run: |
|
|
git diff --cached --name-only --diff-filter=A | while read -r f; do
|
|
[ -f "$f" ] || continue
|
|
sz=$(wc -c < "$f")
|
|
if [ "$sz" -gt 10485760 ]; then
|
|
echo "BLOCKED: $f is $((sz/1048576))MB. Use Git LFS or exclude it."
|
|
exit 1
|
|
fi
|
|
done
|