@theholocron/cli 4.18.0 → 4.18.2

package/README.md

@@ -157,10 +157,13 @@ export default defineConfig({
 ```
 
 `holocron setup` writes `.husky/pre-push` (runs `holocron ci` before every
-push) and sets `package.json#scripts.prepare` to `husky`. On by default for
+push) and `.husky/pre-commit` (runs `gitleaks protect --staged` + `lint-staged`
+before every commit — scoped to staged changes, not the whole history, so a
+past false positive can't permanently block future commits) and sets
+`package.json#scripts.prepare` to `husky`. Both on by default for
 `protection: "strict"`; `false` / `{ prePush: false }` opts out. `holocron
 setup --hooks` / `--no-hooks` override per run. Bypass one push with `git push
---no-verify`.
+--no-verify`; bypass one commit with `git commit --no-verify`.
 
 ### Task scripts
 

package/dist/cli.mjs

@@ -3563,19 +3563,19 @@ var alexrc_default = { allow: [
 ] };
 //#endregion
 //#region src/templates/configs/alexjs/create-config.ts
-const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
+const { workflowHeader: workflowHeader$7 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
 function createRcConfig() {
 	return JSON.stringify(alexrc_default, null, 2) + "\n";
 }
 function createIgnoreConfig() {
-	return `${workflowHeader$6()}${alexignore_default}`;
+	return `${workflowHeader$7()}${alexignore_default}`;
 }
 //#endregion
 //#region src/templates/configs/devmoji/create-config.ts
-const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
-function createConfig$4() {
+const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
+function createConfig$5() {
 	return [
-		workflowHeader$5("cjs"),
+		workflowHeader$6("cjs"),
 		`/* eslint-disable */`,
 		`const { defineConfig } = require("@theholocron/devmoji-config");`,
 		`module.exports = defineConfig();`,
@@ -3587,9 +3587,9 @@ function createConfig$4() {
 var editorconfig_default = "root = true\n\n[*]\nend_of_line = lf\ncharset = utf-8\ntrim_trailing_whitespace = true\ninsert_final_newline = true\nindent_style = tab\nindent_size = 4\n\n[.gitattributes]\nindent_style = space\nindent_size = 2\n\n[*.{json,yml,yaml}]\nindent_style = space\nindent_size = 2\n\n[*.{md,mdx}]\ntrim_trailing_whitespace = false\n\n[.*{rc,ignore}]\nindent_style = space\nindent_size = 2\n";
 //#endregion
 //#region src/templates/configs/editorconfig/create-config.ts
-const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
-function createConfig$3() {
-	return `${workflowHeader$4()}${editorconfig_default}`;
+const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
+function createConfig$4() {
+	return `${workflowHeader$5()}${editorconfig_default}`;
 }
 //#endregion
 //#region src/templates/configs/editorconfig-checker/editorconfig-checker.json
@@ -3630,10 +3630,31 @@ var editorconfig_checker_default = {
 * options here (`Exclude`, `Disable`) are stable across releases, so pinning
 * buys nothing.
 */
-function createConfig$2() {
+function createConfig$3() {
 	return JSON.stringify(editorconfig_checker_default, null, 2) + "\n";
 }
 //#endregion
+//#region src/templates/configs/pre-commit/pre-commit
+var pre_commit_default = "# Run GitLeaks against staged changes only — a full `gitleaks git` history\n# scan re-flags every pre-existing (already-merged) finding on every commit,\n# permanently blocking the repo once any false positive lands in history.\n# CI's super-linter GITLEAKS validator is likewise scoped to changed files.\ngitleaks protect --staged --no-banner\n\n# Exit with non-zero if secrets are detected by GitLeaks\nif [ $? -ne 0 ]; then\n	echo \"Secrets detected by GitLeaks, aborting commit!\"\n	exit 1\nfi\n\n# Run lint-staged with a custom config\nnpx lint-staged --config @theholocron/lint-staged-config\n";
+//#endregion
+//#region src/templates/configs/pre-commit/create-config.ts
+const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/pre-commit/create-config.ts" });
+/**
+* `.husky/pre-commit` — runs GitLeaks (scoped to staged changes) and
+* lint-staged before every commit. Installed by `holocron setup` when hooks
+* are enabled (default for `protection: "strict"`). `git commit --no-verify`
+* bypasses it.
+*
+* `gitleaks protect --staged` (not `gitleaks git`) is deliberate: the latter
+* scans the entire commit history on every invocation, so once any false
+* positive lands in a past commit — a fake test token, an example key in a
+* doc — every future commit is permanently blocked, regardless of what's
+* actually staged.
+*/
+function createConfig$2() {
+	return `${workflowHeader$4("shebang")}${pre_commit_default}`;
+}
+//#endregion
 //#region src/templates/configs/pre-push/pre-push
 var pre_push_default = "# Run the merge-gating checks locally before pushing — the same set CI runs.\n# Bypass once with:  git push --no-verify\n\n# CI runners (semantic-release, super-linter auto-commit, bots) push without a\n# built dev environment — the hook has nothing to add there.\n[ -n \"$CI\" ] && exit 0\n\n__HOLOCRON_SCRIPT__ ci\n";
 //#endregion
@@ -4484,6 +4505,7 @@ const { workflowHeader: workflowHeader$1 } = createHeader({
 });
 async function runSetup(input) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = getLogger();
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
 	await withSpinner("Loading plugins…", () => loader.load());
 	assertPluginsResolvable(loader, "setup");
@@ -4530,7 +4552,8 @@ async function runSetup(input) {
 			if (config.extraRequiredChecks) tasksConfig.extraRequiredChecks = config.extraRequiredChecks;
 			const requiredChecks = effectivePreset === "strict" ? ["DCO", ...createAstromech({
 				cwd: input.context.repoRoot,
-				config: tasksConfig
+				config: tasksConfig,
+				logger
 			}).requiredChecks()] : [];
 			steps.push(await upsertBranchProtection(source, dryRun, requiredChecks));
 			print(formatStep(steps[steps.length - 1]));
@@ -4546,7 +4569,8 @@ async function runSetup(input) {
 			orgContext: {
 				org: config.org,
 				domain: config.domain
-			}
+			},
+			logger
 		}).thinCallers();
 		for (const entry of tasks) {
 			const name = typeof entry === "string" ? entry : entry.name;
@@ -4603,15 +4627,15 @@ async function runSetup(input) {
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig", createConfig$3());
+			await source.writeRepoFile(".editorconfig", createConfig$4());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig-checker.json", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig-checker.json", createConfig$2());
+			await source.writeRepoFile(".editorconfig-checker.json", createConfig$3());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write devmoji.config.cjs", dryRun, async () => {
-			await source.writeRepoFile("devmoji.config.cjs", createConfig$4());
+			await source.writeRepoFile("devmoji.config.cjs", createConfig$5());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .husky/prepare-commit-msg", dryRun, async () => {
@@ -4624,6 +4648,11 @@ async function runSetup(input) {
 				return "runs `holocron ci` before push — bypass with `git push --no-verify`";
 			}));
 			print(formatStep(steps[steps.length - 1]));
+			steps.push(await runStep("source", "write .husky/pre-commit", dryRun, async () => {
+				await source.writeRepoFile(".husky/pre-commit", createConfig$2());
+				return "runs GitLeaks (staged-only) + lint-staged before commit";
+			}));
+			print(formatStep(steps[steps.length - 1]));
 			if (config.syncScripts !== false) {
 				steps.push(await runStep("source", "set package.json prepare script", dryRun, async () => {
 					return await ensurePrepareScript(input.context.repoRoot) ? "prepare now runs husky" : "already runs husky";
@@ -4638,6 +4667,13 @@ async function runSetup(input) {
 				message: "git hooks disabled"
 			});
 			print(formatStep(steps[steps.length - 1]));
+			steps.push({
+				capability: "source",
+				step: "write .husky/pre-commit",
+				status: "skip",
+				message: "git hooks disabled"
+			});
+			print(formatStep(steps[steps.length - 1]));
 		}
 		{
 			const hasTestWorkflow = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("test");
@@ -4649,7 +4685,10 @@ async function runSetup(input) {
 				message: "no test workflow configured"
 			});
 			else steps.push(await runStep("source", "write codecov.yml", dryRun, async () => {
-				const content = createAstromech({ cwd: input.context.repoRoot }).codecovConfig(existing);
+				const content = createAstromech({
+					cwd: input.context.repoRoot,
+					logger
+				}).codecovConfig(existing);
 				await source.writeRepoFile("codecov.yml", content);
 				const packageCount = readWorkspacePackages(input.context.repoRoot).length;
 				return packageCount > 0 ? `${packageCount} components` : "no components";
@@ -5788,7 +5827,8 @@ async function runSync(input) {
 					orgContext: {
 						org: config.org,
 						domain: config.domain
-					}
+					},
+					logger
 				}).thinCallers();
 				for (const entry of taskEntries) {
 					const name = typeof entry === "string" ? entry : entry.name;
@@ -5826,7 +5866,8 @@ async function runSync(input) {
 			if (config.holocronScript !== void 0) tasksConfig.holocronScript = config.holocronScript;
 			const desired = createAstromech({
 				cwd: input.context.repoRoot,
-				config: tasksConfig
+				config: tasksConfig,
+				logger
 			}).packageScripts();
 			steps.push(await runSyncStep("local", "sync scripts", dryRun, async () => {
 				const changed = await mergePackageJsonScripts(input.context.repoRoot, desired);