Add pre-commit config for repo hygiene and secret detection - #334
Add pre-commit config for repo hygiene and secret detection#334Harshaada wants to merge 3 commits into
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📝 WalkthroughSummary by CodeRabbit
WalkthroughThe repository now includes a pre-commit configuration with validation and secret-scanning hooks. ChangesPre-commit adoption
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.pre-commit-config.yaml:
- Around line 10-14: Preserve the existing project checks by updating the
pre-commit configuration around the hooks list to run the equivalent of
scripts/check-secrets.sh and make lint test, or ensure the legacy
scripts/pre-commit chain remains invoked alongside the configured hooks. Keep
both the pre-commit hook checks and the project-specific checks active.
- Around line 23-27: Add a separate full-repository Gitleaks scan alongside the
existing gitleaks hook, using a command such as gitleaks detect --source .; keep
the current staged-change hook unchanged and ensure the new scan runs against
the entire repository rather than passed filenames.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d3e22625-e81c-41bb-8ad9-87b18e3dcd2a
📒 Files selected for processing (2)
.pre-commit-config.yamlCONTRIBUTING.md
| repos: | ||
| # Generic file and repo hygiene (pre-commit/pre-commit-hooks) | ||
| - repo: https://github.com/pre-commit/pre-commit-hooks | ||
| rev: v6.0.0 | ||
| hooks: |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|\.)pre-commit|^scripts/pre-commit|^Makefile|check-secrets' || true
echo
echo "== .pre-commit-config.yaml =="
cat -n .pre-commit-config.yaml
echo
echo "== scripts/pre-commit =="
cat -n scripts/pre-commit
echo
echo "== Makefile relevant lines =="
sed -n '180,210p' Makefile | cat -n
echo
echo "== scripts/check-secrets related =="
if [ -x scripts/check-secrets.sh ]; then cat -n scripts/check-secrets.sh; fi
echo
echo "== pre-commit install references =="
rg -n "pre-commit install|scripts/pre-commit|\.git/hooks/pre-commit|make lint test|check-secrets" Makefile .pre-commit-config.yaml scripts || trueRepository: redhat-data-and-ai/usernaut
Length of output: 15586
Preserve the existing project checks.
.pre-commit.config.yaml installs hooks via pre-commit install, but Makefile installs .git/hooks/pre-commit from scripts/pre-commit, which runs scripts/check-secrets.sh and make lint test. That make lint test step is not replaced by the added pre-commit hooks. Add an equivalent local hook, or make the legacy hook chain both pre-commit and the project checks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.pre-commit-config.yaml around lines 10 - 14, Preserve the existing project
checks by updating the pre-commit configuration around the hooks list to run the
equivalent of scripts/check-secrets.sh and make lint test, or ensure the legacy
scripts/pre-commit chain remains invoked alongside the configured hooks. Keep
both the pre-commit hook checks and the project-specific checks active.
Source: Path instructions
| # Secret detection (requires Go >= 1.23.8; run: brew upgrade go) | ||
| - repo: https://github.com/gitleaks/gitleaks | ||
| rev: v8.28.0 | ||
| hooks: | ||
| - id: gitleaks |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
https://raw.githubusercontent.com/gitleaks/gitleaks/v8.28.0/.pre-commit-hooks.yaml |
grep -A8 'id: gitleaks'Repository: redhat-data-and-ai/usernaut
Length of output: 800
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path(".pre-commit-config.yaml")
print("exists:", p.exists())
if p.exists():
lines = p.read_text(encoding="utf-8").splitlines()
for i, line in enumerate(lines, start=1):
if 19 <= i <= 30:
print(f"{i:4}: {line}")
PYRepository: redhat-data-and-ai/usernaut
Length of output: 503
Provide a full-repository Gitleaks scan path.
The Gitleaks pre-commit hook runs gitleaks git --pre-commit --redact --staged --verbose with pass_filenames: false, so staged hook execution only scans staged changes. Add a separate full-repository scan, such as a new pre-commit hook with gitleaks detect --source . or gitleaks git --staged-only, or document the required command.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.pre-commit-config.yaml around lines 23 - 27, Add a separate full-repository
Gitleaks scan alongside the existing gitleaks hook, using a command such as
gitleaks detect --source .; keep the current staged-change hook unchanged and
ensure the new scan runs against the entire repository rather than passed
filenames.
Source: Path instructions
Signed-off-by: Harrshada <hgaikwad@redhat.com>
Signed-off-by: Harrshada <hgaikwad@redhat.com>
Signed-off-by: Harrshada <hgaikwad@redhat.com>
5bcdcdd to
cfe26f1
Compare
1 participant
Changes
📝 Description
What changed?
Why is this change needed?
Contributors currently have no shared local checks for common file issues and accidental secret commits. Pre-commit gives a consistent gate before code reaches GitHub (where secret scanning / push protection can add defense in depth).
Dependencies
Local: pip install pre-commit (Go >= 1.23.8 for the gitleaks hook)
🧪 Testing
Test Coverage
Performance Impact
🚀 Deployment
Deploy Steps
Prerequisites
Post-Deployment Monitoring
Rollback Plan
Revert this PR / remove .pre-commit-config.yaml if needed
Details:
⚙️ Configuration Changes
✅ Developer Checklist