diff --git a/template/.pre-commit-config.yaml.jinja b/template/.pre-commit-config.yaml.jinja index fdb98c7..88b18cb 100644 --- a/template/.pre-commit-config.yaml.jinja +++ b/template/.pre-commit-config.yaml.jinja @@ -17,12 +17,13 @@ repos: - id: pretty-format-yaml args: [--autofix, --offset, '2'] exclude: ^\.copier-answers\.yml$ - - repo: https://github.com/gitleaks/gitleaks - rev: v8.30.1 - hooks: - - id: gitleaks - repo: local hooks: + - id: betterleaks + name: betterleaks + entry: betterleaks git . --pre-commit --staged --redact + language: system + pass_filenames: false - id: ruff name: ruff entry: uv run ruff check --fix diff --git a/template/mise.toml.jinja b/template/mise.toml.jinja index 27e801e..8528a53 100644 --- a/template/mise.toml.jinja +++ b/template/mise.toml.jinja @@ -8,6 +8,7 @@ postinstall = [ ] [tools] +betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -73,6 +74,11 @@ run = [ description = "Create and push a release tag (patch/minor/major)" raw_args = true run = "uv run bump-my-version bump -v" + +[tasks.secretscan] +description = "Scan git history for secrets" +raw_args = true +run = "betterleaks git . --redact" {%- if "syrupy" in enable_features %} [tasks.snapup] diff --git a/template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/ci.yaml.jinja b/template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/ci.yaml.jinja index a2a78b6..ae695a4 100644 --- a/template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/ci.yaml.jinja +++ b/template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/ci.yaml.jinja @@ -91,7 +91,7 @@ jobs: run: mise run docs-build {%- endif %} - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -102,8 +102,12 @@ jobs: with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %} + run: mise run secretscan {#- vim: set ft=yaml: #} diff --git a/tests/template/__snapshots__/test_mise_toml.ambr b/tests/template/__snapshots__/test_mise_toml.ambr index e1d294e..d0dbeed 100644 --- a/tests/template/__snapshots__/test_mise_toml.ambr +++ b/tests/template/__snapshots__/test_mise_toml.ambr @@ -10,6 +10,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -63,6 +64,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -126,6 +132,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -186,6 +193,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -249,6 +261,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -288,6 +301,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -351,6 +369,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -397,6 +416,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -460,6 +484,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -513,6 +538,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -581,6 +611,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -641,6 +672,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -709,6 +745,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -748,6 +785,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -816,6 +858,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -862,6 +905,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -930,6 +978,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -983,6 +1032,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -1046,6 +1100,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1106,6 +1161,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -1169,6 +1229,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1208,6 +1269,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -1271,6 +1337,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1317,6 +1384,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.test] description = "Run tests" raw_args = true @@ -1380,6 +1452,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1433,6 +1506,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -1501,6 +1579,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1561,6 +1640,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -1629,6 +1713,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1668,6 +1753,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true @@ -1736,6 +1826,7 @@ ] [tools] + betterleaks = "latest" "pipx:copier" = "latest" prek = "latest" uv = "latest" @@ -1782,6 +1873,11 @@ raw_args = true run = "uv run bump-my-version bump -v" + [tasks.secretscan] + description = "Scan git history for secrets" + raw_args = true + run = "betterleaks git . --redact" + [tasks.snapup] description = "Update test snapshots" raw_args = true diff --git a/tests/template/__snapshots__/test_workflows.ambr b/tests/template/__snapshots__/test_workflows.ambr index 6a59eb7..fc76002 100644 --- a/tests/template/__snapshots__/test_workflows.ambr +++ b/tests/template/__snapshots__/test_workflows.ambr @@ -92,7 +92,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -103,10 +103,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -191,7 +195,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -202,10 +206,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -275,7 +283,7 @@ version: 11.2.8 - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -286,10 +294,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -347,7 +359,7 @@ run: mise run test - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -358,10 +370,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -456,7 +472,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -467,10 +483,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -563,7 +583,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -574,10 +594,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -674,7 +698,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -685,10 +709,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -783,7 +811,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -794,10 +822,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -894,7 +926,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -905,10 +937,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # --- @@ -1003,7 +1039,7 @@ - name: 📖 Build documentation run: mise run docs-build - gitleaks: + betterleaks: name: Secret scan runs-on: ubuntu-latest permissions: @@ -1014,10 +1050,14 @@ with: fetch-depth: 0 + - name: 🍳 Set up mise + uses: jdx/mise-action@v4 + with: + cache: true + install: true + - name: 🔍 Check for secrets - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise run secretscan ''' # ---