kryten-webqueue 0.33.2__tar.gz → 0.33.4__tar.gz

kryten_webqueue-0.33.4/.github/workflows/gitleaks.yml

@@ -0,0 +1,31 @@
+name: Secret Scan (gitleaks)
+
+# Server-side enforcement of the ecosystem secret-scanning requirement.
+# Local pre-commit hooks can be bypassed (--no-verify); this gate cannot.
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history so the scan covers every commit in the push / PR range.
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # gitleaks-action is free for public repos. For a private repo, add a
+          # GITLEAKS_LICENSE org/repo secret (see gitleaks-action docs).
+          # Rules + allowlist are read from .gitleaks.toml at the repo root.

{kryten_webqueue-0.33.2 → kryten_webqueue-0.33.4}/.gitignore

@@ -77,3 +77,6 @@ test-output/
 
 # uv
 uv.lock
+
+# Runtime configs (local only; keep config.example.* tracked)
+config.yaml

kryten_webqueue-0.33.4/.gitleaks.toml

@@ -0,0 +1,6 @@
+title = "kryten-webqueue gitleaks configuration"
+
+# Start from gitleaks' built-in ruleset. Add a narrow allowlist only for genuine
+# test fixtures if any are introduced; never allowlist a real credential.
+[extend]
+useDefault = true

kryten_webqueue-0.33.4/.pre-commit-config.yaml

@@ -0,0 +1,36 @@
+# Pre-commit hooks (Kryten ecosystem).
+#
+# Runs safe auto-fixers (ruff --fix, black) and a secret scan (gitleaks) before each
+# commit. ruff/black apply fixes and abort the commit so you re-stage and commit again.
+# ruff and black run via `uv run` so they use THIS repo's exact locked versions — the same
+# ones CI uses — avoiding formatter/linter drift between local commits and CI.
+#
+# One-time setup per clone:
+#   1. uv sync                         # create the project env (ruff/black live here)
+#   2. Install the gitleaks binary:    winget install Gitleaks.Gitleaks   (macOS: brew install gitleaks)
+#   3. pipx install pre-commit         # or: pip install pre-commit
+#   4. pre-commit install
+#
+# Manual run:  pre-commit run --all-files
+# Config: ruff/black read pyproject.toml; gitleaks reads .gitleaks.toml.
+repos:
+  - repo: local
+    hooks:
+      - id: ruff
+        name: ruff (lint + safe autofix)
+        entry: uv run --no-sync ruff check --fix --force-exclude
+        language: system
+        types_or: [python, pyi]
+        require_serial: true
+      - id: black
+        name: black (format)
+        entry: uv run --no-sync black
+        language: system
+        types_or: [python, pyi]
+        require_serial: true
+      - id: gitleaks
+        name: gitleaks (secret scan)
+        description: Block commits that introduce secrets.
+        entry: gitleaks git --pre-commit --staged --redact --verbose
+        language: system
+        pass_filenames: false