Layer secret leak guardrails

2026-05-22 21:23:15 +00:00
parent 0b528cbb5f
commit d62a391cbf
5 changed files with 195 additions and 47 deletions
--- a/home/doris-dashboard/docs/baselines/README.md
+++ b/home/doris-dashboard/docs/baselines/README.md
@@ -29,8 +29,13 @@ See:
 2. Inspect them for secret-bearing fields.
 3. Commit only a markdown summary or an explicitly redacted artifact.
 4. Prefer human-readable summaries over raw appliance dumps.
-5. Enable the repo guardrail in each clone:
+5. Enable the repo guardrails in each clone:
   ```bash
   git config core.hooksPath .githooks
-   chmod +x .githooks/pre-commit scripts/scan-secret-bearing-artifacts.sh
+   chmod +x .githooks/pre-commit .githooks/pre-push scripts/scan-secret-bearing-artifacts.sh
+   ```
+6. Before a risky push or cleanup branch, run the manual checks too:
+   ```bash
+   scripts/scan-secret-bearing-artifacts.sh --tracked
+   scripts/scan-secret-bearing-artifacts.sh --git-range origin/main..HEAD
   ```