lefthook.secrets.yml

ci-security:
  parallel: false
  commands:
    gitleaks:
      tags: security gotool
      name: gitleaks-scan
      run: gitleaks --config-path=./.gitleaks.toml --commit=latest --redact
      # can support sarif format when we have pipeline extension for this enabled.
    # squealer:
    #   tags: security
    #   name: squealer
    #   run: squealer --config-file ./.squealer.yml

pre-push:
  parallel: false
  commands:
    gitleaks:
      tags: security gotool
      name: gitleaks-scan
      run: gitleaks --config-path=./.gitleaks.toml --commit=latest --redact

# go install github.com/owenrumney/squealer/cmd/squealer@latest
pre-commit:
  parallel: true
  tags: security
  commands:
    # Install with: go install github.com/owenrumney/squealer/cmd/squealer@latest
    squealer:
      name: squealer
      run: squealer --config-file ./squealer.yml
    # Install with: go install -v github.com/zricethezav/gitleaks@latest
    gitleaks:
      tags: security gotool
      name: gitleaks-scan
      # run: docker run -v ${PWD}:/repo zricethezav/gitleaks:latest --path="/repo" --pretty -v
      run: gitleaks --config-path=.gitleaks.toml --unstaged -v # This expands to past commits --repo-path=