coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: enforce staged secret scanning on reviewed workstation checkouts

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 17:47:19 +02:00
parent a9a29d82a8
commit 21498306ec
3 changed files with 51 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.githooks/pre-commit Executable file
View file

@ -0,0 +1,9 @@
#!/bin/sh
# CUST-WP-0080 / RMGR-WP-0021: preserve generated-only guard and exact local scan scope.
set -eu
python3 /home/worsch/the-custodian/scripts/check_generated_only_commit.py --staged
case "$(git rev-parse --show-toplevel)" in
/home/worsch/access-engine|/home/worsch/approval-engine|/home/worsch/audit-core|/home/worsch/gate-house|/home/worsch/glas-harness|/home/worsch/key-cape|/home/worsch/kings-guard|/home/worsch/maturity-engine|/home/worsch/net-kingdom|/home/worsch/ops-mason|/home/worsch/ops-warden|/home/worsch/policy-nexus|/home/worsch/railiance-forge|/home/worsch/railiance-platform|/home/worsch/repo-manager|/home/worsch/role-engine|/home/worsch/secrets-engine|/home/worsch/security-canon|/home/worsch/tenant-engine|/home/worsch/the-custodian|/home/worsch/user-engine|/home/worsch/zone-engine)
exec python3 /home/worsch/repo-manager/src/repo_manager/secret_scan.py --path . --binary /home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks
;;
esac