Added secret scanning pre-commit hook (#27609)

ref
https://linear.app/tryghost/issue/NY-1247/add-a-git-pre-commit-hook-to-check-for-secrets-in-staged

- Added secret lint dependency & configuration
- Added pre-commit hook that scans staged changes for secrets, blocking
commits that fail the check

---------

Co-authored-by: Steve Larson <9larsons@gmail.com>

Author: cmraible

.github/hooks/pre-commit.bash

@@ -3,6 +3,11 @@
 
 [ -n "$CI" ] && exit 0
 
+green='\033[0;32m'
+no_color='\033[0m'
+grey='\033[0;90m'
+red='\033[0;31m'
+
 pnpm lint-staged --relative
 lintStatus=$?
 
@@ -11,13 +16,62 @@ if [ $lintStatus -ne 0 ]; then
     exit 1
 fi
 
-green='\033[0;32m'
-no_color='\033[0m'
-grey='\033[0;90m'
-red='\033[0;31m'
+##
+## 1) Scan staged text files for secrets
+##
+
+scan_staged_secrets() {
+    local file
+    local files_scanned=0
+    local scan_status=0
+    local tmpfile
+
+    if ! pnpm exec secretlint --version >/dev/null 2>&1; then
+        echo -e "${red}secretlint is not available. Run pnpm install from the repository root.${no_color}"
+        return 1
+    fi
+
+    if ! tmpfile=$(mktemp); then
+        echo -e "${red}Could not create temp file for secret scanning${no_color}"
+        return 1
+    fi
+
+    echo -e "Scanning staged files for secrets ${grey}(pre-commit hook)${no_color} "
+
+    while IFS= read -r -d '' file; do
+        if ! git show ":$file" > "$tmpfile"; then
+            scan_status=1
+            continue
+        fi
+
+        if LC_ALL=C grep -Iq . "$tmpfile"; then
+            files_scanned=$((files_scanned + 1))
+
+            if ! pnpm exec secretlint --format=compact --stdinFileName="$file" < "$tmpfile"; then
+                scan_status=1
+            fi
+        fi
+    done < <(git diff --cached --name-only --diff-filter=ACMR -z)
+
+    if [ $files_scanned -eq 0 ]; then
+        echo "No staged text files to scan, continuing..."
+    fi
+
+    rm -f "$tmpfile"
+
+    return $scan_status
+}
+
+scan_staged_secrets
+secretScanStatus=$?
+
+if [ $secretScanStatus -ne 0 ]; then
+    echo -e "${red}❌ Secret scanning failed${no_color}"
+    exit 1
+fi
 
 ##
-## 1) Check and remove submodules before committing
+## 2) Check and remove submodules before committing
 ##
 
 ROOT_DIR=$(git rev-parse --show-cdup)
@@ -47,7 +101,7 @@ else
 fi
 
 ##
-## 2) Suggest shipping a new version of @tryghost/activitypub when changes are detected
+## 3) Suggest shipping a new version of @tryghost/activitypub when changes are detected
 ##    The intent is to ship smaller changes more frequently to production
 ##
 

.secretlintrc.json

@@ -0,0 +1,38 @@
+{
+  "rules": [
+    {
+      "id": "@secretlint/secretlint-rule-preset-recommend"
+    },
+    {
+      "id": "@secretlint/secretlint-rule-pattern",
+      "options": {
+        "patterns": [
+          {
+            "name": "Tinybird token",
+            "patterns": [
+              "/\\b(?<CREDENTIAL>p\\.eyJ[A-Za-z0-9_-]{15,}\\.[A-Za-z0-9_-]{20,})\\b/"
+            ]
+          },
+          {
+            "name": "credential in URL query string",
+            "patterns": [
+              "/[?&](?:token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret|password)=(?<CREDENTIAL>(?!p\\.)[^&\\s\"'<>]{16,})/i"
+            ]
+          },
+          {
+            "name": "credential assignment",
+            "patterns": [
+              "/(?:^|[\\s{\"',])\\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|private[_-]?key|password)\\b\\s*[:=]\\s*[\"']?(?<CREDENTIAL>[A-Za-z0-9_./+=:-]{20,})[\"']?/i"
+            ]
+          },
+          {
+            "name": "authorization header",
+            "patterns": [
+              "/\\bAuthorization\\s*:\\s*(?:Bearer|Basic)\\s+(?<CREDENTIAL>[A-Za-z0-9_./+=:-]{20,})/i"
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}

package.json

@@ -119,6 +119,8 @@
   "devDependencies": {
     "@actions/core": "3.0.0",
     "@playwright/test": "1.59.1",
+    "@secretlint/secretlint-rule-pattern": "12.3.1",
+    "@secretlint/secretlint-rule-preset-recommend": "12.3.1",
     "chalk": "4.1.2",
     "chokidar": "3.6.0",
     "eslint": "catalog:",
@@ -130,6 +132,7 @@
     "lint-staged": "16.4.0",
     "nx": "22.0.4",
     "rimraf": "6.1.3",
+    "secretlint": "12.3.1",
     "semver": "7.7.4",
     "typescript": "5.9.3"
   },