@theholocron/cli 4.18.1 → 4.18.3

package/README.md

@@ -157,10 +157,13 @@ export default defineConfig({
 ```
 
 `holocron setup` writes `.husky/pre-push` (runs `holocron ci` before every
-push) and sets `package.json#scripts.prepare` to `husky`. On by default for
+push) and `.husky/pre-commit` (runs `gitleaks protect --staged` + `lint-staged`
+before every commit — scoped to staged changes, not the whole history, so a
+past false positive can't permanently block future commits) and sets
+`package.json#scripts.prepare` to `husky`. Both on by default for
 `protection: "strict"`; `false` / `{ prePush: false }` opts out. `holocron
 setup --hooks` / `--no-hooks` override per run. Bypass one push with `git push
---no-verify`.
+--no-verify`; bypass one commit with `git commit --no-verify`.
 
 ### Task scripts
 

package/dist/cli.mjs

@@ -3563,19 +3563,19 @@ var alexrc_default = { allow: [
 ] };
 //#endregion
 //#region src/templates/configs/alexjs/create-config.ts
-const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
+const { workflowHeader: workflowHeader$7 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
 function createRcConfig() {
 	return JSON.stringify(alexrc_default, null, 2) + "\n";
 }
 function createIgnoreConfig() {
-	return `${workflowHeader$6()}${alexignore_default}`;
+	return `${workflowHeader$7()}${alexignore_default}`;
 }
 //#endregion
 //#region src/templates/configs/devmoji/create-config.ts
-const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
-function createConfig$4() {
+const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
+function createConfig$5() {
 	return [
-		workflowHeader$5("cjs"),
+		workflowHeader$6("cjs"),
 		`/* eslint-disable */`,
 		`const { defineConfig } = require("@theholocron/devmoji-config");`,
 		`module.exports = defineConfig();`,
@@ -3587,9 +3587,9 @@ function createConfig$4() {
 var editorconfig_default = "root = true\n\n[*]\nend_of_line = lf\ncharset = utf-8\ntrim_trailing_whitespace = true\ninsert_final_newline = true\nindent_style = tab\nindent_size = 4\n\n[.gitattributes]\nindent_style = space\nindent_size = 2\n\n[*.{json,yml,yaml}]\nindent_style = space\nindent_size = 2\n\n[*.{md,mdx}]\ntrim_trailing_whitespace = false\n\n[.*{rc,ignore}]\nindent_style = space\nindent_size = 2\n";
 //#endregion
 //#region src/templates/configs/editorconfig/create-config.ts
-const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
-function createConfig$3() {
-	return `${workflowHeader$4()}${editorconfig_default}`;
+const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
+function createConfig$4() {
+	return `${workflowHeader$5()}${editorconfig_default}`;
 }
 //#endregion
 //#region src/templates/configs/editorconfig-checker/editorconfig-checker.json
@@ -3630,10 +3630,31 @@ var editorconfig_checker_default = {
 * options here (`Exclude`, `Disable`) are stable across releases, so pinning
 * buys nothing.
 */
-function createConfig$2() {
+function createConfig$3() {
 	return JSON.stringify(editorconfig_checker_default, null, 2) + "\n";
 }
 //#endregion
+//#region src/templates/configs/pre-commit/pre-commit
+var pre_commit_default = "# Run GitLeaks against staged changes only — a full `gitleaks git` history\n# scan re-flags every pre-existing (already-merged) finding on every commit,\n# permanently blocking the repo once any false positive lands in history.\n# CI's super-linter GITLEAKS validator is likewise scoped to changed files.\ngitleaks protect --staged --no-banner\n\n# Exit with non-zero if secrets are detected by GitLeaks\nif [ $? -ne 0 ]; then\n	echo \"Secrets detected by GitLeaks, aborting commit!\"\n	exit 1\nfi\n\n# Run lint-staged with a custom config\nnpx lint-staged --config @theholocron/lint-staged-config\n";
+//#endregion
+//#region src/templates/configs/pre-commit/create-config.ts
+const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/pre-commit/create-config.ts" });
+/**
+* `.husky/pre-commit` — runs GitLeaks (scoped to staged changes) and
+* lint-staged before every commit. Installed by `holocron setup` when hooks
+* are enabled (default for `protection: "strict"`). `git commit --no-verify`
+* bypasses it.
+*
+* `gitleaks protect --staged` (not `gitleaks git`) is deliberate: the latter
+* scans the entire commit history on every invocation, so once any false
+* positive lands in a past commit — a fake test token, an example key in a
+* doc — every future commit is permanently blocked, regardless of what's
+* actually staged.
+*/
+function createConfig$2() {
+	return `${workflowHeader$4("shebang")}${pre_commit_default}`;
+}
+//#endregion
 //#region src/templates/configs/pre-push/pre-push
 var pre_push_default = "# Run the merge-gating checks locally before pushing — the same set CI runs.\n# Bypass once with:  git push --no-verify\n\n# CI runners (semantic-release, super-linter auto-commit, bots) push without a\n# built dev environment — the hook has nothing to add there.\n[ -n \"$CI\" ] && exit 0\n\n__HOLOCRON_SCRIPT__ ci\n";
 //#endregion
@@ -4606,15 +4627,15 @@ async function runSetup(input) {
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig", createConfig$3());
+			await source.writeRepoFile(".editorconfig", createConfig$4());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig-checker.json", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig-checker.json", createConfig$2());
+			await source.writeRepoFile(".editorconfig-checker.json", createConfig$3());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write devmoji.config.cjs", dryRun, async () => {
-			await source.writeRepoFile("devmoji.config.cjs", createConfig$4());
+			await source.writeRepoFile("devmoji.config.cjs", createConfig$5());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .husky/prepare-commit-msg", dryRun, async () => {
@@ -4627,6 +4648,11 @@ async function runSetup(input) {
 				return "runs `holocron ci` before push — bypass with `git push --no-verify`";
 			}));
 			print(formatStep(steps[steps.length - 1]));
+			steps.push(await runStep("source", "write .husky/pre-commit", dryRun, async () => {
+				await source.writeRepoFile(".husky/pre-commit", createConfig$2());
+				return "runs GitLeaks (staged-only) + lint-staged before commit";
+			}));
+			print(formatStep(steps[steps.length - 1]));
 			if (config.syncScripts !== false) {
 				steps.push(await runStep("source", "set package.json prepare script", dryRun, async () => {
 					return await ensurePrepareScript(input.context.repoRoot) ? "prepare now runs husky" : "already runs husky";
@@ -4641,6 +4667,13 @@ async function runSetup(input) {
 				message: "git hooks disabled"
 			});
 			print(formatStep(steps[steps.length - 1]));
+			steps.push({
+				capability: "source",
+				step: "write .husky/pre-commit",
+				status: "skip",
+				message: "git hooks disabled"
+			});
+			print(formatStep(steps[steps.length - 1]));
 		}
 		{
 			const hasTestWorkflow = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("test");