@ministryofjustice/hmpps-precommit-hooks 2.0.0-beta.3 → 2.0.0-beta.5

package/README.md

@@ -45,10 +45,10 @@ HMPPS_HOOKS_VERSION: 1
 repos:
   - repo: local
     hooks:
-      - repo: https://github.com/ministryofjustice/devsecops-hooks
-        rev: v1.x.x
-    hooks:
-      - id: baseline
+      - id: gitleaks
+        name: Scan commit for secrets
+        language: system
+        entry: gitleaks git --pre-commit --redact --staged --verbose --config .gitleaks/config.toml --gitleaks-ignore-path .gitleaks/.gitleaksignore
       - id: lint
         name: linting code
         language: system
@@ -111,7 +111,7 @@ See the gitleaks documentation for how to create rules and [examples](https://gi
 
 ### Keeping up to date
 
-`prek auto-update` can be used to pull in later versions of hooks including the devsecops-hooks.
+`prek auto-update` can be used to pull in later versions of hooks.
 
 Also, a manager can be added to your renovate.json config to allow renovate to raise PRs to keep hooks up to date:
 

package/bin/prepare.sh

@@ -24,16 +24,14 @@ fi
 
 
 # Remove husky if installed
-if [ -f "node_modules/.bin/husky" ]; then
+if [ -f ".husky/pre-commit" ]; then
   startStage "Removing husky"
   npm uninstall husky
   endStage " ✅ "
 
-  if [ -f ".husky/pre-commit" ]; then
-    startStage "Deleting existing husky pre-commit hooks"
-    rm -Rf .husky
-    endStage " ✅ "
-  fi
+  startStage "Deleting existing husky pre-commit hooks"
+  rm -Rf .husky
+  endStage " ✅ "
 fi
 
 # Check brew exists
@@ -42,6 +40,13 @@ if ! command -v brew > /dev/null 2> /dev/null; then
   exit 0
 fi
 
+# Install gitleaks if not present - this will be used by prek for secret scanning until we move over to devsecops hooks
+if ! command -v gitleaks > /dev/null 2> /dev/null; then
+  startStage "Installing gitleaks"
+  brew install gitleaks
+  endStage " ✅ "
+fi
+
 # Install prek
 if ! command -v prek > /dev/null 2> /dev/null; then
   startStage "Installing prek"

package/default-hooks.yaml

@@ -5,12 +5,19 @@
 # Other hooks maybe added or removed as needed to suit individual project requirements.
 
 repos:
-  - repo: https://github.com/ministryofjustice/devsecops-hooks
-    rev: v1.3.0
-    hooks:
-      - id: baseline
+  #. Temporary disabled while we investigate issues with it
+  #  - repo: https://github.com/ministryofjustice/devsecops-hooks
+  #    rev: v1.1.0
+  #    hooks:
+  #      - id: baseline
   - repo: local
     hooks:
+      - id: gitleaks
+        name: Scan commit for secrets
+        language: system
+        entry: gitleaks git --pre-commit --redact --staged --verbose --config .gitleaks/config.toml --gitleaks-ignore-path .gitleaks/.gitleaksignore
+        require_serial: true
+        pass_filenames: false
       - id: lint
         name: linting code
         language: system

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ministryofjustice/hmpps-precommit-hooks",
-  "version": "2.0.0-beta.3",
+  "version": "2.0.0-beta.5",
   "description": "Precommit hooks for HMPPS typescript projects",
   "keywords": [
     "precommit"
@@ -32,8 +32,5 @@
   ],
   "engines": {
     "node": "20 || 22 || 24"
-  },
-  "dependencies": {
-    "husky": "^9.1.7"
   }
 }