From 5b7283d1151925974e64ef6dca687eb3dd5fb88d Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 16 Oct 2026 13:16:58 +0200 Subject: [PATCH] chore(pre-commit): scope the private-key hook exclusion and drop the dead gitleaks ignore The detect-private-key hook skipped every *_test.go file and a frontend path that does not exist in this repo, so a real key committed in any test file went unchecked. Exclude only the two files that embed PEM-shaped dummy keys (cmd/configure_test.go, cmd/configure_gcp_test.go), found by running the hook with no exclude. .gitleaksignore is removed: nothing here runs gitleaks and its only entry points at a file that does not exist in this repo. Closes #448 Co-Authored-By: Claude Opus 5.5 --- .gitleaksignore | 3 --- .pre-commit-config.yaml | 7 ++----- 2 files changed, 2 insertions(+), 8 deletions(-) delete mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore deleted file mode 100644 index 671857722..000000000 --- a/.gitleaksignore +++ /dev/null @@ -1,3 +0,0 @@ -# AWS official example credentials used in tests -# See: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-access-keys-and-secret-access-keys -internal/secrets/aws_resolver_httptest_test.go diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 36e3ab7da..7d499836c 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -48,11 +48,8 @@ repos: name: Check for merge conflicts - id: detect-private-key name: Detect private keys - # Audit (PR5): internal/credentials/resolver.go contains zero - # private-key-shaped patterns (verified by grep). The exclusion - # was a historical artifact; removing it tightens the gate - # without breaking any legitimate code. - exclude: '(_test\.go|frontend/src/index\.html)$' + # Only these test fixtures embed PEM-shaped dummy keys; any other file is scanned. + exclude: '^(cmd/configure_test\.go|cmd/configure_gcp_test\.go)$' - id: check-case-conflict name: Check for case conflicts