feat: add lefthook pre-commit hooks with gitleaks secret scanning - #2364
Open
panish16 wants to merge 2 commits into
Open
feat: add lefthook pre-commit hooks with gitleaks secret scanning#2364panish16 wants to merge 2 commits into
panish16 wants to merge 2 commits into
Conversation
Pilot rollout of the Git Hooks RFC (bcgov/entity#34619) to a polyrepo-style monorepo, following the reference implementation in bcgov/connect#38: a root-level lefthook.yml runs per-service lint (scoped via `root:` to ppr-ui, ppr-api, mhr-api independently) and a repo-wide gitleaks secret scan before each commit. Since this repo has no root package.json today, added a minimal hooks-only one - the services keep their own independent dependency management.
Without this, pnpm's CI mode (frozen-lockfile / CI=true) hard-fails with ERR_PNPM_IGNORED_BUILDS instead of just warning, since lefthook ships a postinstall script pnpm won't run without explicit approval.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pilot rollout of the Git Hooks RFC (bcgov/entity#34619) to a polyrepo-style monorepo, following the reference implementation in bcgov/connect#38:
package.jsontoday (ppr-ui,ppr-api,mhr-apieach manage their own deps independently) - added a minimal, hooks-only rootpackage.jsonsopnpm installat the repo root is the single setup step, without touching each service's own tooling.lefthook.ymlruns lint scoped per-service viaroot:(ppr-ui-lint,ppr-api-lint,mhr-api-lint), so a commit touching one service doesn't trigger checks for the others.secret-scanruns unscoped, across the whole staged changeset.eslintforppr-ui,poetry run flake8forppr-api/mhr-api(perbcgov/bcregistry-sre's sharedbackend-ci.yaml)..gitleaks.toml(extends default ruleset, allowlists lockfiles includingpoetry.lock) and a short README dev-setup note.Test plan
pnpm installat repo root installs the hook and downloads/checksum-verifies gitleaks v8.30.1git commit: all three per-service lint commands correctly skip when no matching staged files exist,secret-scanruns and passesroot:scoping actually routes correctly: staged a throwaway file underppr-api/and confirmed onlyppr-api-linttriggered, whileppr-ui-lint/mhr-api-lintstayed skippedRelated: bcgov/entity#34619, template: bcgov/connect#38, single-app pilot: bcgov/bcregistry#278