Add detect-secrets pre-commit hook and baseline

[tsvikas]

Summary

Integrate secret detection into the project's pre-commit hooks and initialization workflow to prevent accidental commits of sensitive credentials.

Key Changes

• Added detect-secrets as a new security hook in the pre-commit configuration
  • Configured to validate against a .secrets.baseline file
• Updated the project initialization script to generate the initial secrets baseline
  • Runs detect-secrets scan during just init to create .secrets.baseline
  • Automatically commits the baseline file with a security-focused commit message

Implementation Details

• The detect-secrets hook will run on every commit to catch any new secrets before they're committed
• The baseline file is generated during initial project setup to establish a known state of any pre-existing secrets
• Uses uvx to run detect-secrets without requiring it as a direct project dependency

https://claude.ai/code/session_01PS6USVBi11LZAmfhotZGHU

[sourcery-ai]

Hey - I've left some high level feedback:

• The init recipe unconditionally runs uvx detect-secrets scan > .secrets.baseline and then commits it; consider making this idempotent (e.g., only regenerating/committing when the baseline changes, and guarding the commit with a git status check) so rerunning just init doesn’t fail or clobber local updates to the baseline.
• Running detect-secrets scan without any path or exclusion flags will scan everything under the repo; you may want to explicitly scope or exclude paths (e.g., build artifacts, virtualenvs) to avoid noise and oversized baselines.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `init` recipe unconditionally runs `uvx detect-secrets scan > .secrets.baseline` and then commits it; consider making this idempotent (e.g., only regenerating/committing when the baseline changes, and guarding the commit with a `git status` check) so rerunning `just init` doesn’t fail or clobber local updates to the baseline.
- Running `detect-secrets scan` without any path or exclusion flags will scan everything under the repo; you may want to explicitly scope or exclude paths (e.g., build artifacts, virtualenvs) to avoid noise and oversized baselines.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}