From 97dc16f116f24f19302a097fb10c9d4bd1adca26 Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Sun, 30 Aug 2026 08:29:17 -0500
Subject: [PATCH] git: global pre-commit secrets scan via gitleaks

Adds core.hooksPath pointing at dotfiles-managed hooks. The hook runs
gitleaks on staged changes and chains to any repo-local pre-commit hook
so per-repo hooks are not silently skipped.
---
 Brewfile             | 1 +
 git/gitconfig        | 1 +
 git/hooks/pre-commit | 9 +++++++++
 3 files changed, 11 insertions(+)
 create mode 100755 git/hooks/pre-commit

diff --git a/Brewfile b/Brewfile
index 2d59b5d..6cc8098 100644
--- a/Brewfile
+++ b/Brewfile
@@ -44,6 +44,7 @@ brew "gnupg"
 brew "sops"
 brew "git"
 brew "git-crypt"
+brew "gitleaks"
 brew "fzf"
 brew "zoxide"
 brew "lsd"
diff --git a/git/gitconfig b/git/gitconfig
index 59688f3..1f4a489 100644
--- a/git/gitconfig
+++ b/git/gitconfig
@@ -4,6 +4,7 @@
   signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3jigIrPb+1u0V8pJk4m41hP/WBgAm7gei6Edyr9vca
 [core]
   excludesFile = /Users/sethetter/.gitignore
+  hooksPath = /Users/sethetter/dotfiles/git/hooks
 [diff]
   colorMoved = default
 [difftool]
diff --git a/git/hooks/pre-commit b/git/hooks/pre-commit
new file mode 100755
index 0000000..1b3b56d
--- /dev/null
+++ b/git/hooks/pre-commit
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Global pre-commit hook: secrets scan, then run any repo-local hook.
+
+gitleaks protect --staged --verbose || exit 1
+
+local_hook="$(git rev-parse --git-dir)/hooks/pre-commit"
+if [ -x "$local_hook" ]; then
+  "$local_hook" "$@" || exit 1
+fi
-- 
2.51.2