Phase 2: Pre-commit Hook & GitHub Action

[ToryMic]

Phase 2 — Pre-commit & GitHub Action

Depends on: Phase 1 ✅

Deliverables

• vaultsweep install-hook — install pre-commit hook
• GitHub Action: BreachDirect/vaultsweep-action
• .vaultsweep-baseline for incremental adoption
• Inline ignore: # vaultsweep:ignore comment support
• Action README with Wave contributor examples

Acceptance criteria

• Pre-commit blocks commits with critical findings locally
• GitHub Action fails PR on --fail-on high
• Baseline file suppresses known legacy findings
• make ci still passes

Wave alignment

• #29 Secure key storage