Andriy Oblivantsev
9ead554f5c
Release Please / Release Please (push) Skipped
Release / GoReleaser (push) Skipped
Tests / Secret scan (gitleaks) (push) Skipped
Tests / Test (Go 1.25) (push) Skipped
Tests / Test (Go stable) (push) Skipped
Tests / Secret scan (gitleaks) (pull_request) Successful in 4s
Tests / Test (Go 1.25) (pull_request) Successful in 48s
Tests / Test (Go stable) (pull_request) Successful in 51s
21 lines
601 B
Bash
Executable File
21 lines
601 B
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# pre-commit git hook — blocks a commit if staged changes contain a secret.
|
|
# Scans only the staged (index) diff with gitleaks (via secret-scan.sh).
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
|
|
ROOT="$(git rev-parse --show-toplevel)"
|
|
if [[ "$SCRIPT_DIR" == "$ROOT/scripts/githooks" ]]; then
|
|
SCAN="$SCRIPT_DIR/secret-scan.sh"
|
|
else
|
|
SCAN="$ROOT/scripts/githooks/secret-scan.sh"
|
|
fi
|
|
|
|
if ! "$SCAN" --staged; then
|
|
echo "pre-commit: LEAK FOUND in staged changes; commit BLOCKED. Remove the secret first." >&2
|
|
exit 1
|
|
fi
|
|
exit 0
|