Conversation
Part of the Git Hooks RFC rollout (bcgov/entity#34619). No root package.json existed, so this adds a minimal hooks-only one, matching the approach used on bcgov/ppr#2364. Scoped to secret scanning only (bare 'npx gitleaks-secret-scanner', no custom install script, matching bcregistry/connect/ppr) - this repo has 16 separately-versioned services each with their own CI-enforced lint, so this intentionally doesn't attempt to replicate per-service lint wiring the way ppr's pilot did; that's a separate, larger effort if wanted later. prepare is guarded with '|| exit 0' from the start, learned from bcgov/bcregistry#281 breaking CD after merging this same base setup unguarded.
panish16
requested review from
davemck513,
mengdong19,
ozamani9gh and
stevenc987
as code owners
September 23, 2026 17:15
lefthook's own npm postinstall already skips itself under CI=true by default (only installs if LEFTHOOK=1/true is explicitly set - see https://lefthook.dev/usage/envs/LEFTHOOK.html). Our prepare script called 'lefthook install' directly though, which bypasses that and always runs - that's what broke bcgov/bcregistry#281's CD build (no git in the image). '|| exit 0' (the fix used on bcregistry/ppr) stops the failure from crashing the install, but still attempts the install in CI every time. This skips it outright when CI is set, since hooks have no purpose in a non-interactive build anyway.
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the Git Hooks RFC rollout (bcgov/entity#34619). Now unblocked - the hold on namex changes (pending the solr migration) was lifted 2026-09-14.
No root
package.jsonexisted, so this adds a minimal hooks-only one, matching the approach used on bcgov/ppr#2364 (also a repo with no root package.json).Scoped to secret scanning only - bare
npx gitleaks-secret-scanner, no custom install script, matching the pattern now live on bcregistry/connect/ppr. This repo has 16 separately-versioned services (api,jobs,solr-admin-app,solr-feeder,solr-synonyms-api, etc.), each with its own CI-enforced lint already. Intentionally not attempting to replicate per-service lint wiring the way ppr's pilot did for its 3 services - that's a much larger, separate effort if wanted later.prepareskipslefthook installentirely whenCI=true, rather than just swallowing a failure:lefthook's own npm postinstall already skips itself under
CI=trueby default; ourpreparescript calling the CLI directly bypassed that, which is what broke bcgov/bcregistry#281's CD build (no git in that image).|| exit 0(used on bcregistry/ppr) stops the crash but still attempts the install every time in CI. This skips it outright, since hooks have no purpose in a non-interactive build.Verified with real
git commit, not just local dry-run: hook installs, and a fake secret gets caught and blocks the commit whether it's at repo root or nested under a subfolder likeapi/.