Add gitleaks

Ramblurr · Feb 24, 2025 · adcc791 · adcc791
1 parent 11e417d
commit adcc791
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 0 deletions.
diff --git a/.github/lint/gitleaks.toml b/.github/lint/gitleaks.toml
@@ -0,0 +1,25 @@
+title = "gitleaks config"
+
+[extend]
+useDefault = true
+
+[[ rules ]]
+    id = "generic-api-key"
+    [ rules.allowlist ]
+    paths = [ 'secrets/.*\.nix', 'secrets/.*\.secrets' ]
+    regexTarget = "line"
+    regexes= [
+      "signing.key =.*",
+      "signingKey =.*"
+    ]
+
+[allowlist]
+description = "ignore sops encrypted secrets"
+paths = [
+'.*\.sops\.yaml',
+]
+regexTarget = "line"
+regexes= [
+  '''ExAmPl3PA55W0rD''',
+  '''.*ENC\[AES256_GCM,data:.*''',
+]
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -37,3 +37,11 @@ repos:
       - id: remove-crlf
       - id: remove-tabs
         exclude: (Makefile)
+
+  - repo: https://github.com/zricethezav/gitleaks
+    rev: v8.23.3
+    hooks:
+      - id: gitleaks
+        args:
+          - --config
+          - .github/lint/gitleaks.toml