HYPERFLEET-1019 - docs: add LeakTK secret scanning to pre-commit hooks#139
HYPERFLEET-1019 - docs: add LeakTK secret scanning to pre-commit hooks#139ldornele wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis pull request updates the pre-commit hooks documentation to introduce LeakTK as the new secret scanning solution. The changes expand prerequisites to include Go 1.25+ and btrfs development headers, add a new "Secret Scanning Hook" section describing the LeakTK hook, include a LeakTK repository block in the standard Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hyperfleet/docs/pre-commit-hooks.md`:
- Around line 316-323: Update the migration doc to include CI/CD steps so repos
continue enforcing hooks: explicitly instruct CI pipelines to install LeakTK
prerequisites (Go 1.25+ and btrfs-progs-devel), build the LeakTK/pre-commit
binary (same build used by developers) and cache it between jobs, replace
references to rh-pre-commit with the new built pre-commit binary invocation, and
add a CI step that runs the pre-commit binary (mirroring the developer `make
install-hooks` behavior) while noting the one-time compilation cost and how to
use pipeline cache to avoid it; reference the terms rh-pre-commit, LeakTK, make
install-hooks, and pre-commit in the doc so maintainers can locate and update
pipeline configs accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 2fef7d4f-54d0-423e-96e1-045f3c18332a
📒 Files selected for processing (1)
hyperfleet/docs/pre-commit-hooks.md
| **Step 3: Notify team** | ||
|
|
||
| Inform all developers that: | ||
| 1. System requirements must be met (Go 1.25+, btrfs-progs-devel) | ||
| 2. They should reinstall hooks: `make install-hooks` | ||
| 3. The **first commit** will take 3-5 minutes (one-time compilation) | ||
| 4. Subsequent commits will run instantly (cached binary) | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win
Add explicit CI/CD migration steps, not only developer-local steps.
The migration section says to notify developers, but it omits how CI jobs should install LeakTK prerequisites and run pre-commit after replacing rh-pre-commit. Since this migration affects shared enforcement, missing CI guidance creates inconsistent policy enforcement across repos.
Suggested doc addition
**Step 3: Notify team**
Inform all developers that:
1. System requirements must be met (Go 1.25+, btrfs-progs-devel)
2. They should reinstall hooks: `make install-hooks`
3. The **first commit** will take 3-5 minutes (one-time compilation)
4. Subsequent commits will run instantly (cached binary)
+
+Also update CI pipelines that run pre-commit:
+- Install LeakTK build prerequisites in CI images/runners (Go + btrfs headers).
+- Run `pre-commit run --all-files` (or your repo-standard pre-commit target) in CI.
+- Pin the same `.pre-commit-config.yaml` revision used by developers to keep local/CI behavior identical.As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity. Validate changes against HyperFleet architecture standards from the linked architecture repository."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| **Step 3: Notify team** | |
| Inform all developers that: | |
| 1. System requirements must be met (Go 1.25+, btrfs-progs-devel) | |
| 2. They should reinstall hooks: `make install-hooks` | |
| 3. The **first commit** will take 3-5 minutes (one-time compilation) | |
| 4. Subsequent commits will run instantly (cached binary) | |
| **Step 3: Notify team** | |
| Inform all developers that: | |
| 1. System requirements must be met (Go 1.25+, btrfs-progs-devel) | |
| 2. They should reinstall hooks: `make install-hooks` | |
| 3. The **first commit** will take 3-5 minutes (one-time compilation) | |
| 4. Subsequent commits will run instantly (cached binary) | |
| Also update CI pipelines that run pre-commit: | |
| - Install LeakTK build prerequisites in CI images/runners (Go + btrfs headers). | |
| - Run `pre-commit run --all-files` (or your repo-standard pre-commit target) in CI. | |
| - Pin the same `.pre-commit-config.yaml` revision used by developers to keep local/CI behavior identical. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hyperfleet/docs/pre-commit-hooks.md` around lines 316 - 323, Update the
migration doc to include CI/CD steps so repos continue enforcing hooks:
explicitly instruct CI pipelines to install LeakTK prerequisites (Go 1.25+ and
btrfs-progs-devel), build the LeakTK/pre-commit binary (same build used by
developers) and cache it between jobs, replace references to rh-pre-commit with
the new built pre-commit binary invocation, and add a CI step that runs the
pre-commit binary (mirroring the developer `make install-hooks` behavior) while
noting the one-time compilation cost and how to use pipeline cache to avoid it;
reference the terms rh-pre-commit, LeakTK, make install-hooks, and pre-commit in
the doc so maintainers can locate and update pipeline configs accordingly.
| Or via Homebrew on macOS: | ||
|
|
||
| ```bash | ||
| brew install btrfs-progs | ||
| ``` |
There was a problem hiding this comment.
Warning
Blocking
Category: Bug
brew install btrfs-progs doesn't exist on Homebrew — btrfs is a Linux-only filesystem (verified with brew search btrfs).
Per LeakTK's own build docs, btrfs-progs-devel is only needed when CGO_ENABLED=1. Setting CGO_ENABLED=0 removes the system dependency entirely and is the simplest path, especially for macOS.
Consider restructuring the prerequisite and migration sections to:
- Recommend
CGO_ENABLED=0as the default (no system deps needed, works on all platforms) - Keep the
btrfs-progs-devel/libbtrfs-devinstructions as a fallback for those who need CGO enabled - Remove the macOS
brew install btrfs-progsinstruction entirely
# Example: if using pre-commit and CGO_ENABLED=1, install btrfs headers
# Fedora/RHEL: sudo dnf install btrfs-progs-devel
# Ubuntu/Debian: sudo apt install libbtrfs-dev
# macOS: set CGO_ENABLED=0 (no btrfs package available)
|
|
||
| --- | ||
|
|
||
| ### Adding Pre-commit Hooks to a Repository |
There was a problem hiding this comment.
Tip
nit — non-blocking suggestion
Category: Inconsistency
This heading is at ### (h3) — the same level as the ### Step 1: through ### Step 7: below it, making them siblings instead of children. By contrast, the new ### Secret Scanning Migration section properly nests its children at #### (h4).
Consider changing the Step headings below to #### to nest them under this wrapper, matching the pattern used in the Secret Scanning Migration section.
2 participants
Summary
Adds comprehensive documentation for LeakTK secret scanning as the recommended replacement for rh-pre-commit in HyperFleet repositories. LeakTK is an open-source secret scanning toolkit developed by Red Hat's
InfoSec team that removes VPN requirements while maintaining the same Gitleaks-based detection with Red Hat-specific patterns.
Changes Made
Documentation Updates
Added LeakTK secret scanning hook section
leaktk.git.pre-commitdetailsAdded migration guide: rh-pre-commit → LeakTK
Updated standard configuration
.pre-commit-config.yamltemplateAdded troubleshooting sections
Updated metadata
New References
Why This Change?
Benefits of LeakTK over rh-pre-commit
Trade-offs
Migration Impact
Who is affected?
Action Required
For new repositories: Use the updated
.pre-commit-config.yamltemplate from this documentation.For existing repositories using rh-pre-commit: Follow the migration guide in the "Secret Scanning Migration" section.