Skip to content

Add pre-commit config for repo hygiene and secret detection #334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Harshaada wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add pre-commit config for repo hygiene and secret detection #334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8f26782
pre-commit config for Usernaut repo
Aug 10, 2026
c121a54
updated the instructions
Aug 10, 2026
5bcdcdd
excluded vendor file
Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# Pre-commit hooks for usernaut (whole repo).
#
# Install: pip install pre-commit && pre-commit install
# Run manually: pre-commit run --all-files

exclude: ^vendor/

repos:
# Generic file and repo hygiene (pre-commit/pre-commit-hooks)
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
hooks:
Comment on lines +8 to +12

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files =="
git ls-files | rg '(^|\.)pre-commit|^scripts/pre-commit|^Makefile|check-secrets' || true

echo
echo "== .pre-commit-config.yaml =="
cat -n .pre-commit-config.yaml

echo
echo "== scripts/pre-commit =="
cat -n scripts/pre-commit

echo
echo "== Makefile relevant lines =="
sed -n '180,210p' Makefile | cat -n

echo
echo "== scripts/check-secrets related =="
if [ -x scripts/check-secrets.sh ]; then cat -n scripts/check-secrets.sh; fi

echo
echo "== pre-commit install references =="
rg -n "pre-commit install|scripts/pre-commit|\.git/hooks/pre-commit|make lint test|check-secrets" Makefile .pre-commit-config.yaml scripts || true

Repository: redhat-data-and-ai/usernaut

Length of output: 15586

Preserve the existing project checks.

.pre-commit.config.yaml installs hooks via pre-commit install, but Makefile installs .git/hooks/pre-commit from scripts/pre-commit, which runs scripts/check-secrets.sh and make lint test. That make lint test step is not replaced by the added pre-commit hooks. Add an equivalent local hook, or make the legacy hook chain both pre-commit and the project checks.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.pre-commit-config.yaml around lines 10 - 14, Preserve the existing project
checks by updating the pre-commit configuration around the hooks list to run the
equivalent of scripts/check-secrets.sh and make lint test, or ensure the legacy
scripts/pre-commit chain remains invoked alongside the configured hooks. Keep
both the pre-commit hook checks and the project-specific checks active.

Source: Path instructions

- id: trailing-whitespace
- id: end-of-file-fixer
exclude: ^CODEOWNERS$ # script + CI validate; avoid pre-commit changing trailing newlines
- id: check-yaml
args: [--allow-multiple-documents]
- id: detect-private-key
- id: check-merge-conflict

# Secret detection (requires Go >= 1.23.8; run: brew upgrade go)
- repo: https://github.com/gitleaks/gitleaks
rev: v8.28.0
hooks:
- id: gitleaks
Comment on lines +21 to +25

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

curl -fsSL \
  https://raw.githubusercontent.com/gitleaks/gitleaks/v8.28.0/.pre-commit-hooks.yaml |
  grep -A8 'id: gitleaks'

Repository: redhat-data-and-ai/usernaut

Length of output: 800

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path(".pre-commit-config.yaml")
print("exists:", p.exists())
if p.exists():
    lines = p.read_text(encoding="utf-8").splitlines()
    for i, line in enumerate(lines, start=1):
        if 19 <= i <= 30:
            print(f"{i:4}: {line}")
PY

Repository: redhat-data-and-ai/usernaut

Length of output: 503

Provide a full-repository Gitleaks scan path.

The Gitleaks pre-commit hook runs gitleaks git --pre-commit --redact --staged --verbose with pass_filenames: false, so staged hook execution only scans staged changes. Add a separate full-repository scan, such as a new pre-commit hook with gitleaks detect --source . or gitleaks git --staged-only, or document the required command.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.pre-commit-config.yaml around lines 23 - 27, Add a separate full-repository
Gitleaks scan alongside the existing gitleaks hook, using a command such as
gitleaks detect --source .; keep the current staged-change hook unchanged and
ensure the new scan runs against the entire repository rather than passed
filenames.

Source: Path instructions

20 changes: 13 additions & 7 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,23 +10,29 @@ We welcome contributions to Usernaut! If you find a bug, have a feature request,
```

3. **Make Changes**: Implement your changes and ensure they are well-tested.
4. **Commit Your Changes**: Commit your changes with a descriptive commit message:
4. **Install pre-commit** (recommended):

```bash
pip install pre-commit && pre-commit install
```

5. **Commit Your Changes**: Commit your changes with a descriptive commit message:

```bash
git commit -m "Add my feature"
```

5. **Push to Your Fork**: Push your changes to your forked repository:
6. **Push to Your Fork**: Push your changes to your forked repository:

```bash
git push origin feature/my-feature
```

6. **Create a Pull Request**: Open a pull request against the `main` branch of the Usernaut repository. Provide a clear description of your changes and why they are needed.
7. **Review Process**: Your pull request will be reviewed by the Usernaut maintainers. They may request changes or provide feedback.
8. **Address Feedback**: If changes are requested, make the necessary updates in your branch and push the changes. The pull request will automatically update.
9. **Merge**: Once your pull request is approved, it will be merged into the main branch.
10. **Celebrate**: Congratulations! You've contributed to Usernaut.
7. **Create a Pull Request**: Open a pull request against the `main` branch of the Usernaut repository. Provide a clear description of your changes and why they are needed.
8. **Review Process**: Your pull request will be reviewed by the Usernaut maintainers. They may request changes or provide feedback.
9. **Address Feedback**: If changes are requested, make the necessary updates in your branch and push the changes. The pull request will automatically update.
10. **Merge**: Once your pull request is approved, it will be merged into the main branch.
11. **Celebrate**: Congratulations! You've contributed to Usernaut.

## License

Expand Down