ci: scan staged changes for secrets
b8db3bf6f419ac82d6103a3d51e5fcc43a3f930f
Oliver Jan Krylow <oliver@bugabinga.net> · 2026-08-29 02:31 UTC
unverifiable SSH 1 parent
repositories / bugabinga.net
bugabinga.net
personal infrastructure for bugabinga!
owned by admin
Changed files (2)
README.md
ready@@ -12,6 +12,7 @@
- [opentofu][opentofu]: IaC language
- [just][just]: command runner
- [lefthook][lefthook]: git commit hooks
+- [gitleaks][gitleaks]: staged secret scanning
- `podman`: build and transfer the custom Luci image to klops
- `go` 1.26+: build and test the Luci service under `services/luci`
- `python-bcrypt` (Arch: `sudo pacman -S python-bcrypt`): generate bcrypt
@@ -154,3 +155,4 @@
[opentofu]: https://opentofu.org
[just]: https://just.systems
[lefthook]: https://lefthook.dev
+[gitleaks]: https://gitleaks.io
lefthook.yml
ready@@ -3,8 +3,11 @@
# This file defines git hooks for this repo.
# These hooks need to be initially applied using `lefthook install` in the root directory of this repo.
pre-commit:
jobs:
+ - name: secrets
+ run: gitleaks git --pre-commit --staged --redact --no-banner
+
- name: format
run: tofu fmt
stage_fixed: true