Mannu
c5ca1e0214
Layout, secret hygiene and workflow per the engagement's version control plan. Nothing functional yet — this establishes the shape before code lands, so the conventions are enforced from the first real commit. - .gitignore + .env.example: no secret can reach a commit object - lefthook + gitleaks pre-commit gate; blocks new files >10MB - templates/ holds config files, never per-template scripts - deploy/nginx/ version controlled rather than hand-edited on the server Refs ADR-007
16 lines
504 B
YAML
16 lines
504 B
YAML
# Pre-commit gate. Installed with: lefthook install
|
|
pre-commit:
|
|
parallel: true
|
|
commands:
|
|
gitleaks:
|
|
run: gitleaks protect --staged --no-banner --redact
|
|
no-large-files:
|
|
run: |
|
|
git diff --cached --name-only --diff-filter=A | while read -r f; do
|
|
[ -f "$f" ] || continue
|
|
sz=$(wc -c < "$f")
|
|
if [ "$sz" -gt 10485760 ]; then
|
|
echo "BLOCKED: $f is $((sz/1048576))MB. Use Git LFS or exclude it."
|
|
exit 1
|
|
fi
|
|
done
|