🔧 switching over from pre-commit to ruby-only solution

.git-hooks/pre_commit/gitleaks.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Overcommit
+  module Hook
+    module PreCommit
+      # Local script to run gitleaks
+      class Gitleaks < Base
+        # Runs the command.
+        def run
+          result = execute(['gitleaks', 'git', '--staged', '-v', '.'])
+
+          return :pass if result.success?
+
+          [:fail, result.stdout + result.stderr]
+        end
+      end
+    end
+  end
+end

.github/workflows/_static-analysis.yml

@@ -22,31 +22,16 @@ jobs:
         ruby-version: "3.2.0"
         bundler-cache: true
 
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: "3.x"
-
-    - name: Install pre-commit
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install pre-commit
-
-    - name: Run pre-commit checks (security + hygiene)
+    - name: Run Gitleaks
+      uses: gitleaks/gitleaks-action@v2
       env:
-        SKIP: rubocop,steep
-      run: |
-        pre-commit run --all-files --show-diff-on-failure
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITLEAKS_EXCLUDE: "^(spec/data/|docs/code_samples/|local_test/)"
 
     - name: Analyse the code with Rubocop
       run: |
         bundle install
-        bundle exec rubocop ./
-
-    - name: Attempt to generate the documentation
-      run: |
-        bundle exec rake doc
-
-    - name: Check types using Steep
-      run: |
-        bundle exec steep check
+        bundle exec overcommit --install
+        bundle exec overcommit --sign
+        bundle exec overcommit --sign pre-commit
+        SKIP=Gitleaks bundle exec overcommit --run

.overcommit.yml

@@ -0,0 +1,46 @@
+PreCommit:
+  MergeConflicts:
+    enabled: true
+
+  YamlSyntax:
+    enabled: true
+
+  TrailingWhitespace:
+    enabled: true
+
+  FileSize:
+    enabled: true
+    byte_limit: 1048576
+
+  RuboCop:
+    enabled: true
+    required_executable: 'bundle'
+    command: ['bundle', 'exec', 'rubocop', '--force-exclusion', '--no-server']
+
+  CustomScript:
+    enabled: true
+    description: 'Run Steep type checking'
+    required_executable: 'bundle'
+    command: ['bundle', 'exec', 'steep', 'check']
+
+  Gitleaks:
+    enabled: true
+    required_executable: 'gitleaks'
+  CommitMsg:
+    enabled: false
+    CapitalizedSubject:
+      enabled: false
+    TextWidth:
+      enabled: false
+    TrailingPeriod:
+      enabled: false
+    SingleLineSubject:
+      enabled: false
+    EmptyMessage:
+      enabled: false
+
+PrePush:
+  BundleAudit:
+    enabled: true
+    required_executable: 'bundle'
+    command: ['sh', '-c', 'bundle exec bundle-audit check']

mindee.gemspec

@@ -37,6 +37,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'pdf-reader', '~> 2.15'
 
   spec.add_development_dependency 'bundle-audit', '~> 0.2.0'
+  spec.add_development_dependency 'overcommit', '~> 0.71'
   spec.add_development_dependency 'rbs', '~> 3.10'
   spec.add_development_dependency 'rubocop', '~> 1.86'
   spec.add_development_dependency 'steep', '~> 1.10'