ayo
0a3571e2f4
Adds scripts/check-content.mjs, a zero-dependency scanner for commits, branch names, PR text, and contributed lines. It checks structural rules (attribution trailers and footers, session links) and a maintainer-managed reserved-terms list, shipped as salted digests in .repo-policy.json. Findings report a location and a masked preview, never the matched term. Wired up opt-in: the pre-commit hook scans the staged diff and branch name, a new commit-msg hook scans the message, and the Checks workflow gates PRs and pushes to main. The digest list ships empty; structural checks run regardless.
16 lines
747 B
Text
16 lines
747 B
Text
echo "pre-commit..."
|
|
npm run lint
|
|
|
|
# Secret scan of staged files — blocks committing tokens, private keys, or a
|
|
# stray .env.production before it ever reaches history. Config: .secretlintrc.json
|
|
# / .secretlintignore. Full-tree scan: `pnpm run scan:secrets`.
|
|
staged=$(git diff --cached --name-only --diff-filter=ACM)
|
|
if [ -n "$staged" ]; then
|
|
echo "secret-scan (staged files)..."
|
|
printf '%s\n' "$staged" | xargs -r -d '\n' npx secretlint --secretlintignore .secretlintignore
|
|
fi
|
|
|
|
# Content policy check of the staged diff and the branch name. Config:
|
|
# .repo-policy.json. Full-tree sweep: `node scripts/check-content.mjs --all`.
|
|
echo "content-check (staged)..."
|
|
node scripts/check-content.mjs --staged --branch "$(git branch --show-current)"
|