Jon Chery
df58bc25a3
---ci--- project: orca phase: 3 milestone: v0.3 status: complete requirements: covered: [REQ-022, REQ-030, REQ-032] partial: [] ---/ci--- v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that was previously on the milestone branch but not yet merged to main, plus the v0.3 completion work (iter.Seq streaming + doctor network/db). v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan). v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor), P3 (final review+ship). Total: 40 requirements, all complete. No new go.mod dependencies. Full test suite passes under -race. gofmt + go vet clean.
24 lines
831 B
Bash
Executable File
24 lines
831 B
Bash
Executable File
#!/bin/bash
|
|
# .githooks/pre-commit — gitleaks pre-commit gate (P03, REQ-039).
|
|
#
|
|
# Runs `gitleaks protect --staged` on every commit. If gitleaks is
|
|
# not installed, the hook is a no-op (the commit proceeds). CI
|
|
# catches the same findings via `.coreci.yml` `validate` pipeline.
|
|
#
|
|
# Install: `git config core.hooksPath .githooks`
|
|
|
|
set -e
|
|
|
|
if ! command -v gitleaks >/dev/null 2>&1; then
|
|
echo " (gitleaks not installed; skipping pre-commit secret scan; CI will catch it)"
|
|
exit 0
|
|
fi
|
|
|
|
# Find the repo root (this hook lives in .githooks/).
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
# Run gitleaks on staged content. The --baseline-path suppresses
|
|
# pre-existing findings (REQ-029 — the v0.1 .env leak).
|
|
gitleaks protect --staged --config .gitleaks.toml --baseline-path .gitleaks-baseline.json
|