Scan staged files for secrets before commit. Uses gitleaks to detect API keys, tokens, passwords, and other sensitive data. Blocks commit if secrets found. Install: go install github.com/zricethezav/gitleaks/v8@latest
Scan staged files for secrets before git commit. Prevents leaking API keys, passwords, tokens, and other sensitive data. Uses gitleaks for detection.
# Install gitleaks
go install github.com/zricethezav/gitleaks/v8@latest
# Add to PATH (~/.bashrc)
export PATH="$PATH:$(go env GOPATH)/bin"
if ! command -v gitleaks &>/dev/null; then
echo "Error: gitleaks not installed"
echo "Install: go install github.com/zricethezav/gitleaks/v8@latest"
exit 1
fi
# Get staged files
STAGED_FILES=$(git diff --staged --name-only)
if [ -z "$STAGED_FILES" ]; then
echo "No staged files to scan"
exit 0
fi
# Run gitleaks detect (v8+)
# --staged scans only staged changes
# --no-gitignore ignores .gitignore rules
gitleaks detect --staged --no-gitignore --verbose
echo "SECRETS DETECTED - Commit blocked!"
echo ""
echo "To bypass (DANGER), use: git commit --no-verify"
echo "Then rotate exposed credentials immediately"
exit 1
# Create .git/hooks/pre-commit
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/bash
source ~/.config/opencode/skills/precommit-secret-scan.sh
EOF
chmod +x .git/hooks/pre-commit
# Before committing, run this skill
git diff --staged | gitleaks detect --staged
Gitleaks detects:
Create .gitleaks.toml in repo root:
[printer]
no-gitignore = true
[rules]
entropy = 5