Pre-commit hook — secret scan + typecheck #4

New issue

Closed

opened 2026-08-03 14:37:12 +00:00 by Mark · 0 comments

Mark commented

2026-08-03 14:37:12 +00:00

Owner

The repo has nothing stopping secrets, large files, or broken TypeScript from being committed. Add a pre-commit hook modeled on the node.sh template from ~/.hermes/skills/devops/ci-provisioning/templates/pre-commit-hooks/.

Scope:

Secret scan (git history friendly patterns: AWS keys, JWT, ghp_*, generic password =)
Large file reject (>5 MB)
npx tsc --noEmit on staged files

Acceptance:

.git/hooks/pre-commit installed and executable
Blocks a synthetic bad commit
git commit --no-verify works as documented escape hatch

Labels: enhancement

The repo has nothing stopping secrets, large files, or broken TypeScript from being committed. Add a pre-commit hook modeled on the `node.sh` template from `~/.hermes/skills/devops/ci-provisioning/templates/pre-commit-hooks/`. **Scope:** - Secret scan (git history friendly patterns: AWS keys, JWT, `ghp_*`, generic `password =`) - Large file reject (>5 MB) - `npx tsc --noEmit` on staged files **Acceptance:** - `.git/hooks/pre-commit` installed and executable - Blocks a synthetic bad commit - `git commit --no-verify` works as documented escape hatch Labels: enhancement