Add a pre-push secret gate #59

Merged

parkerhdavis merged 1 commit from add-check-secrets into main 2026-10-15 23:49:08 -06:00

Conversation 0 Commits 1 Files changed 3 +113

parkerhdavis commented 2026-10-15 23:49:03 -06:00 (Migrated from github.com)

Copy link

Every .env value (minus publishable keys — paths, versions, BASE_DOMAIN) is searched as a fixed string in the added lines of every commit a push would introduce. New commits only, so values already legitimate in the tree never false-positive.

• scripts/check-secrets.sh — the engine, also available as make check-secrets.
• scripts/hooks/pre-push — install with make hooks (done on phd-razer).
• Verified against the actual leak: the commit that introduced the Obsidian credentials fails with exit 1 naming each secret; the scrub commit and a clean tree pass.

Every `.env` value (minus publishable keys — paths, versions, `BASE_DOMAIN`) is searched as a fixed string in the **added lines** of every commit a push would introduce. New commits only, so values already legitimate in the tree never false-positive. - `scripts/check-secrets.sh` — the engine, also available as `make check-secrets`. - `scripts/hooks/pre-push` — install with `make hooks` (done on phd-razer). - Verified against the actual leak: the commit that introduced the Obsidian credentials fails with exit 1 naming each secret; the scrub commit and a clean tree pass.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

parker/cumulus!59

No description provided.