Archived
beatzaplentyandClaude Sonnet 4.6
b269a5d616
- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns - .github/workflows/secret-scan.yml — GitHub Actions (full history scan) - .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow) - scripts/check-secrets.sh — shared runner used by both CI and local; supports --staged-only for pre-commit hook use; falls back to Docker if gitleaks isn't on PATH - scripts/install-hooks.sh — installs pre-commit hook pointing at above - pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash in pihole.toml in-place before the file is committed - pihole/pull-config.sh — updated to call sanitize-config.sh automatically after every pull so the repo stays clean by default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
18 lines
529 B
Bash
Executable File
18 lines
529 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install git hooks that run the secret scan before every commit.
|
|
# Run once after cloning: bash scripts/install-hooks.sh
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(git -C "$(dirname "$0")" rev-parse --show-toplevel)"
|
|
HOOK="${REPO_ROOT}/.git/hooks/pre-commit"
|
|
|
|
cat > "$HOOK" << 'HOOK'
|
|
#!/usr/bin/env bash
|
|
exec "$(git rev-parse --show-toplevel)/scripts/check-secrets.sh" --staged-only
|
|
HOOK
|
|
|
|
chmod +x "$HOOK"
|
|
echo "Installed pre-commit hook → ${HOOK}"
|
|
echo "The secret scan will run automatically before every commit."
|