mirror of
https://github.com/JamesTurland/JimsGarage.git
synced 2026-07-26 18:38:14 +00:00
d5dadb5f4b
Add a GitHub Actions workflow that runs the project's pre-commit hooks against the files changed in each PR, plus a gitleaks secret scan over the PR's commits. Both block on findings. Enrich the existing .pre-commit-config.yaml with general hygiene checks and four linters (shellcheck, yamllint, actionlint, gitleaks), add a lenient yamllint config tuned for the repo's existing YAML, and add a gitleaks config that keeps the full default ruleset while baselining the repo's pre-existing intentional dummy credentials. Linting is scoped to changed files, so the checks pass on the current tree and only hold new or edited files to standard. - .github/workflows/lint.yml: pull_request workflow, read-only token, two jobs (pre-commit on changed files + gitleaks on the commit range) - .pre-commit-config.yaml: keep existing hooks; add hygiene checks, shellcheck (--severity=warning), yamllint, actionlint, gitleaks - .yamllint.yaml: lenient ruleset - .gitleaks.toml: default rules + allowlist for .env/example placeholders - .gitleaksignore: baseline of pre-existing intentional dummy credentials
22 lines
740 B
YAML
22 lines
740 B
YAML
---
|
|
# Lenient ruleset: this repo has a large body of pre-existing YAML (compose
|
|
# stacks, k8s manifests, Ansible). The goal is to catch real problems on
|
|
# changed files without drowning contributors in stylistic noise.
|
|
extends: default
|
|
|
|
rules:
|
|
# Long lines are common and harmless in compose/k8s/Ansible YAML.
|
|
line-length: disable
|
|
# Many files intentionally omit the leading '---'.
|
|
document-start: disable
|
|
# compose/Ansible use yes/no/on/off as values, not just true/false.
|
|
truthy:
|
|
check-keys: false
|
|
# Indentation styles vary across the repo; only require internal consistency.
|
|
indentation:
|
|
spaces: consistent
|
|
indent-sequences: whatever
|
|
comments:
|
|
min-spaces-from-content: 1
|
|
comments-indentation: disable
|