@synovitec/trellis 0.6.0-rc.2 → 0.6.0-rc.3

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this package. The format follows Keep a Changelog; versio
 
 ## [Unreleased]
 
+## [0.6.0-rc.3] - 2026-10-31
+
+### Fixed
+
+- **The commit checkpoint is installed without gitleaks.** `init --agents` wrote the git hooks only
+  where gitleaks was on, so a machine without it got no `trellis verify` on commit and no
+  attestation at all, and said nothing. The hooks are now always written, and init says the secret
+  scan is off and how to add it.
+- **A secret scan that could not run warns on this machine where the team did not switch gitleaks
+  on**, rather than refusing every commit; where `"gitleaks": true` is set, or the team set
+  `secrets-scanned` itself, it still blocks. CI, which brings its own pinned gitleaks, blocks as
+  before, and a leak found is never softened.
+
 ## [0.6.0-rc.2] - 2026-10-30
 
 The tenth review, on the code the ninth round added, found the secret scan's own reading of team

package/SECURITY.md

@@ -34,7 +34,8 @@ is a seatbelt for an agent that cuts corners, not a sandbox for one that attacks
   does, after quotes and escapes;
 - every check fails closed: a log that does not verify, a scanner that could not run, a registry
   that did not answer, a broken config, a hook whose Trellis is gone (it exits 2) is a finding,
-  never a pass;
+  never a pass. One is a warning rather than a block: a secret scan that could not run on a
+  developer's machine where the team did not switch gitleaks on; CI, with its own gitleaks, blocks;
 - the attestation of each commit is signed with the developer's ed25519 key.
 
 An agent determined to forge evidence with the user's own permissions can still do it: read the key

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synovitec/trellis",
-  "version": "0.6.0-rc.2",
+  "version": "0.6.0-rc.3",
   "description": "Proof that a change got the checks your repository asks for, whoever made it: AI coding agents (Claude Code, Cursor, Codex, Copilot, any MCP agent) and people, held at the commit and verified again in CI with signed in-toto attestations.",
   "license": "Apache-2.0",
   "repository": {

package/src/commands/attest.mjs

@@ -13,7 +13,7 @@ import { buildStatement, existingPublicKeyPem, keyIdOf, readNotes, signEnvelope,
 import { loadConfig, validateConfig } from "../core/config.mjs";
 import { scanCommit } from "../verify/secrets.mjs";
 import { checkDependencies, dependencyChanges } from "../verify/deps.mjs";
-import { evaluate } from "../verify/rules.mjs";
+import { evaluate, localModes } from "../verify/rules.mjs";
 import { testCommands, testScriptChanges } from "../verify/test-commands.mjs";
 
 /**
@@ -76,13 +76,14 @@ async function judgeCommit(ctx, commit, tree, events, env, opts) {
   if (errors.length) return { actor, agent, preset, findings: [{ rule: "config-invalid", mode: "block", message: errors.join("; ") }], verdict: "fail" };
   const changes = commitDiff(ctx.root, commit);
   const deps = dependencyChanges(ctx.root, changes);
+  const secrets = (opts.scanCommit ?? scanCommit)(ctx.root, commit);
   const findings = evaluate({
     changes,
     events,
     actor,
     preset,
-    modes: config?.verify?.rules ?? {},
-    secrets: (opts.scanCommit ?? scanCommit)(ctx.root, commit),
+    modes: localModes(config, secrets),
+    secrets,
     deps: deps.length ? await checkDependencies(deps, { http: opts.http }) : { status: "clean", findings: [], unpinned: [], unchecked: [] },
     depNames: deps.map((d) => d.name),
     testCommands: testCommands((p) => ctx.read(p)),

package/src/commands/init.mjs

@@ -90,7 +90,9 @@ function planAgentHooks(ctx, enabled, writes, notes, agentList) {
     ].filter(Boolean);
     writes.push({ path: SETTINGS, text: settings.text, why: what.join("; ") });
   }
-  if (!enabled.some((e) => e.tool.id === "gitleaks")) return;
+  // The commit checkpoint holds with or without gitleaks: without it, commits are not scanned for
+  // secrets here (CI scans them), and the note says how to add it.
+  if (!enabled.some((e) => e.tool.id === "gitleaks")) notes.push('gitleaks is off, so commits are not scanned for secrets on this machine (CI scans them): install it from github.com/gitleaks/gitleaks, then set "gitleaks": true in trellis.config.json');
   const git = planGitHooks(ctx);
   for (const w of git.writes) writes.push({ ...w, executable: true });
   notes.push(...git.notes);

package/src/commands/verify.mjs

@@ -19,7 +19,7 @@ import { loadConfig, validateConfig } from "../core/config.mjs";
 import { parseJson } from "../core/context.mjs";
 import { scanChanges, scanCommit as scanCommitSecrets, scanStaged } from "../verify/secrets.mjs";
 import { checkDependencies, dependencyChanges } from "../verify/deps.mjs";
-import { evaluate } from "../verify/rules.mjs";
+import { evaluate, localModes } from "../verify/rules.mjs";
 import { isTestCommand, RUNNER_SETTINGS, testCommands, testEnv, testScriptChanges } from "../verify/test-commands.mjs";
 import { matchesAny } from "../agents/glob.mjs";
 import { tmpdir } from "node:os";
@@ -88,13 +88,14 @@ export async function verify(ctx, out, opts = {}) {
   const deps = dependencyChanges(ctx.root, changes);
   const agent = agentAtWork(window.events, env);
   const preset = config?.verify?.preset ?? "recommended";
+  const secrets = (opts.scanSecrets ?? scanStaged)(ctx.root);
   const findings = evaluate({
     changes,
     events: window.events,
     actor: agent ? "agent" : "person",
     preset,
-    modes: config?.verify?.rules ?? {},
-    secrets: (opts.scanSecrets ?? scanStaged)(ctx.root),
+    modes: localModes(config, secrets),
+    secrets,
     deps: deps.length ? await checkDependencies(deps, { http: opts.http }) : { status: "clean", findings: [], unpinned: [], unchecked: [] },
     depNames: deps.map((d) => d.name),
     testCommands: testCommands((p) => ctx.read(p)),

package/src/verify/rules.mjs

@@ -89,6 +89,20 @@ export const TEST_PATHS = Object.freeze([...TEST_FILES, ...GATES]);
 /** @param {string[]} paths */
 const list = (paths) => `${paths.slice(0, 6).join(", ")}${paths.length > 6 ? `, and ${paths.length - 6} more` : ""}`;
 
+/**
+ * The rule modes a commit on this machine is judged under: the team's, except that a secret scan
+ * that could not run warns where the team did not switch gitleaks on (and did not set the rule).
+ * CI, which brings its own gitleaks, still blocks.
+ * @param {any} config  trellis.config.json, or null
+ * @param {import("./secrets.mjs").SecretScan} secrets
+ * @returns {Record<string, Mode>}
+ */
+export function localModes(config, secrets) {
+  const modes = { ...(config?.verify?.rules ?? {}) };
+  if (secrets.status === "unavailable" && !config?.tools?.gitleaks && modes["secrets-scanned"] === undefined) modes["secrets-scanned"] = "warn";
+  return modes;
+}
+
 /**
  * @param {object} input
  * @param {import("../core/diff.mjs").Change[]} input.changes