Add pre-commit config for repo hygiene and secret detection - #334
Add pre-commit config for repo hygiene and secret detection#334Harshaada wants to merge 3 commits into
Conversation
|
Warning Review limit reached
Next review available in: 27 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe repository now includes a pre-commit configuration with validation and secret-scanning hooks. ChangesPre-commit adoption
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.pre-commit-config.yaml:
- Around line 10-14: Preserve the existing project checks by updating the
pre-commit configuration around the hooks list to run the equivalent of
scripts/check-secrets.sh and make lint test, or ensure the legacy
scripts/pre-commit chain remains invoked alongside the configured hooks. Keep
both the pre-commit hook checks and the project-specific checks active.
- Around line 23-27: Add a separate full-repository Gitleaks scan alongside the
existing gitleaks hook, using a command such as gitleaks detect --source .; keep
the current staged-change hook unchanged and ensure the new scan runs against
the entire repository rather than passed filenames.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d3e22625-e81c-41bb-8ad9-87b18e3dcd2a
📒 Files selected for processing (2)
.pre-commit-config.yamlCONTRIBUTING.md
| repos: | ||
| # Generic file and repo hygiene (pre-commit/pre-commit-hooks) | ||
| - repo: https://github.com/pre-commit/pre-commit-hooks | ||
| rev: v6.0.0 | ||
| hooks: |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|\.)pre-commit|^scripts/pre-commit|^Makefile|check-secrets' || true
echo
echo "== .pre-commit-config.yaml =="
cat -n .pre-commit-config.yaml
echo
echo "== scripts/pre-commit =="
cat -n scripts/pre-commit
echo
echo "== Makefile relevant lines =="
sed -n '180,210p' Makefile | cat -n
echo
echo "== scripts/check-secrets related =="
if [ -x scripts/check-secrets.sh ]; then cat -n scripts/check-secrets.sh; fi
echo
echo "== pre-commit install references =="
rg -n "pre-commit install|scripts/pre-commit|\.git/hooks/pre-commit|make lint test|check-secrets" Makefile .pre-commit-config.yaml scripts || trueRepository: redhat-data-and-ai/usernaut
Length of output: 15586
Preserve the existing project checks.
.pre-commit.config.yaml installs hooks via pre-commit install, but Makefile installs .git/hooks/pre-commit from scripts/pre-commit, which runs scripts/check-secrets.sh and make lint test. That make lint test step is not replaced by the added pre-commit hooks. Add an equivalent local hook, or make the legacy hook chain both pre-commit and the project checks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.pre-commit-config.yaml around lines 10 - 14, Preserve the existing project
checks by updating the pre-commit configuration around the hooks list to run the
equivalent of scripts/check-secrets.sh and make lint test, or ensure the legacy
scripts/pre-commit chain remains invoked alongside the configured hooks. Keep
both the pre-commit hook checks and the project-specific checks active.
Source: Path instructions
| # Secret detection (requires Go >= 1.23.8; run: brew upgrade go) | ||
| - repo: https://github.com/gitleaks/gitleaks | ||
| rev: v8.28.0 | ||
| hooks: | ||
| - id: gitleaks |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
https://raw.githubusercontent.com/gitleaks/gitleaks/v8.28.0/.pre-commit-hooks.yaml |
grep -A8 'id: gitleaks'Repository: redhat-data-and-ai/usernaut
Length of output: 800
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path(".pre-commit-config.yaml")
print("exists:", p.exists())
if p.exists():
lines = p.read_text(encoding="utf-8").splitlines()
for i, line in enumerate(lines, start=1):
if 19 <= i <= 30:
print(f"{i:4}: {line}")
PYRepository: redhat-data-and-ai/usernaut
Length of output: 503
Provide a full-repository Gitleaks scan path.
The Gitleaks pre-commit hook runs gitleaks git --pre-commit --redact --staged --verbose with pass_filenames: false, so staged hook execution only scans staged changes. Add a separate full-repository scan, such as a new pre-commit hook with gitleaks detect --source . or gitleaks git --staged-only, or document the required command.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.pre-commit-config.yaml around lines 23 - 27, Add a separate full-repository
Gitleaks scan alongside the existing gitleaks hook, using a command such as
gitleaks detect --source .; keep the current staged-change hook unchanged and
ensure the new scan runs against the entire repository rather than passed
filenames.
Source: Path instructions
1 participant
Changes
📝 Description
What changed?
Why is this change needed?
Contributors currently have no shared local checks for common file issues and accidental secret commits. Pre-commit gives a consistent gate before code reaches GitHub (where secret scanning / push protection can add defense in depth).
Dependencies
Local: pip install pre-commit (Go >= 1.23.8 for the gitleaks hook)
🧪 Testing
Test Coverage
Performance Impact
🚀 Deployment
Deploy Steps
Prerequisites
Post-Deployment Monitoring
Rollback Plan
Revert this PR / remove .pre-commit-config.yaml if needed
Details:
⚙️ Configuration Changes
✅ Developer Checklist