Robin Newhouseandgreptile-apps[bot] 4212c7d447 Add staged secret scan pre-commit hook (#344) ...

## Summary
- use Gitleaks' documented staged pre-commit command instead of a custom
scanner
- add a minimal `.gitleaks.toml` that extends the built-in Gitleaks
rules
- keep the existing `lint-staged` hook after the secret scan

## Research notes
- Gitleaks' official pre-commit metadata uses: `gitleaks git
--pre-commit --redact --staged --verbose`
- Gitleaks git mode scans patches, avoiding the custom scanner's
full-file false-positive issue
- Gitleaks config can extend the default built-in rule set with
`[extend] useDefault = true`

## Verification
- `gitleaks version` -> 8.30.1
- `gitleaks git --pre-commit --redact --staged --verbose`
- `bun biome check package.json --diagnostic-level=error`
- staged a temporary Gitleaks README sample secret and confirmed the
scanner blocks it with redacted output

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

2026-05-01 14:31:56 -07:00

..

pre-commit

Add staged secret scan pre-commit hook (#344)

2026-05-01 14:31:56 -07:00