ci: add gitleaks secret scanning (CI job + pre-commit hook)#21
Merged
Conversation
Add defense-in-depth secret scanning ahead of making the repo public: - CI `secret-scan` job in cli-ci.yml scans full git history on every push/PR using a pinned gitleaks binary (run directly to avoid the gitleaks-action paid license for org repos). - husky pre-commit hook scans staged changes locally and blocks commits containing secrets; skips gracefully if the gitleaks binary is absent. - Shared .gitleaks.toml allowlists only the two public Supabase anon keys by exact value (not by file/rule), so a service_role JWT pasted into the same file would still be caught. - README gains a Development + secret-scanning section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
1 similar comment
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Defense-in-depth secret scanning ahead of making this repo public. Scans for committed credentials at two points so nothing slips through.
What
secret-scanjob (cli-ci.yml) — scans the full git history on every push/PR with a pinned gitleaks binary. Run directly (notgitleaks-action) to avoid the paidGITLEAKS_LICENSErequired for org-owned repos. This is the enforced backstop..gitleaks.toml— allowlists only the two public Supabase anon keys, by exact value (not by file path or the wholejwtrule) so aservice_roleJWT pasted into the same file would still be caught.brew install gitleaks).Verification
Tested the hook locally against gitleaks 8.30.1:
Full-history scan of the current repo is clean (the two anon keys are the only matches, and they're allowlisted).
🤖 Generated with Claude Code